Merge pull request #3649 from forfreeday/feature/security_fixes

fix security issues

Author: zhaohong

chainbase/build.gradle

@@ -40,7 +40,7 @@ dependencies {
     compile group: 'org.rocksdb', name: 'rocksdbjni', version: '5.15.10'
     compile group: 'com.typesafe', name: 'config', version: '1.3.2'
     compile 'com.github.tronprotocol:zksnark-java-sdk:master-SNAPSHOT'
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.8.5'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.9.10.3'
     compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.8.5'
     compile project(":protocol")
     compile project(":common")

common/build.gradle

@@ -38,7 +38,7 @@ dependencies {
     testCompile group: 'junit', name: 'junit', version: '4.12'
     compile "com.madgag.spongycastle:core:1.58.0.0"
     compile "com.madgag.spongycastle:prov:1.58.0.0"
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.8.5'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.9.10.3'
     compile "com.cedarsoftware:java-util:1.8.0"
     compile group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
     compile group: 'commons-codec', name: 'commons-codec', version: '1.11'

framework/build.gradle

@@ -58,7 +58,7 @@ dependencies {
 
     compile group: 'com.google.inject', name: 'guice', version: '4.1.0'
 
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.8.5'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.9.10.3'
     compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.8.5'
 
     compile group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2'
@@ -75,7 +75,7 @@ dependencies {
     // http
     compile 'org.eclipse.jetty:jetty-server:9.4.11.v20180605'
     compile 'org.eclipse.jetty:jetty-servlet:9.4.11.v20180605'
-    compile 'com.alibaba:fastjson:1.2.60'
+    compile 'com.alibaba:fastjson:1.2.70'
     compile group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
     // end http