Uploaded image for project: 'ZK'
  1. ZK
  2. ZK-3857

upgrade jackson library

    XMLWordPrintable

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: Major
    • Resolution: Done
    • Affects Version/s: 8.0.5, 8.5.0, 8.5.1
    • Fix Version/s: 8.5.1
    • Component/s: Databind 2
    • Security Level: Jimmy

      Description

      Upgrade the dackson-databind dependency to address known vulnerabilities:

      https://access.redhat.com/security/cve/cve-2017-7525
      https://access.redhat.com/security/cve/cve-2017-15095
      https://access.redhat.com/security/cve/cve-2017-17485

      fixed in by
      https://github.com/FasterXML/jackson-databind/issues/1599#issuecomment-342983770
      https://github.com/FasterXML/jackson-databind/issues/1837
      https://github.com/FasterXML/jackson-databind/issues/1855

      The latest fix is only available in 2.8.11 and 2.9.4 (both only supporting Java >=7)

      Workaround

      Manually add the dependency for 2.9.4

      <dependency>
          <groupId>com.fasterxml.jackson.core</groupId>
          <artifactId>jackson-databind</artifactId>
          <version>2.9.4</version>
      </dependency>
      

      OR

      exclude jackson-databind and use the GSON converter instead:

      <dependency>
      	<groupId>org.zkoss.zk</groupId>
      	<artifactId>zkmax</artifactId>
      	<version>${zk.version}</version>
      	<exclusions>
      		<exclusion>
      			<groupId>com.fasterxml.jackson.core</groupId>
      			<artifactId>jackson-databind</artifactId>
      		</exclusion>
      	</exclusions>
      </dependency>
      

      in zk.xml (configure the alternative converter)

      <library-property>
      	<name>org.zkoss.bind.jsonBindingParamConverter.class</name>
      	<value>org.zkoss.zkmax.bind.GsonConverter</value>
      </library-property>
      

        Attachments

          Activity

            People

            Assignee:
            rudyhuang rudyhuang
            Reporter:
            cor3000 cor3000
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Time Tracking

                Estimated:
                Original Estimate - 1 hour
                1h
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 hour
                1h