CVE-2022-42004: Transitive dependency (jackson) from io.cloudevents:cloudevents-json-jackson vulnerable

GoogleCloudPlatform / functions-framework-java

FaaS (Function as a service) framework for writing portable Java functions

Apache License 2.0

135 stars 65 forks source link

CVE-2022-42004: Transitive dependency (jackson) from io.cloudevents:cloudevents-json-jackson vulnerable #245

Closed stummb closed 1 week ago

stummb commented 12 months ago

jackson-json is included transitively via cloudevents-json-jackson. The included version is vulnerable (CVE-2022-42004).

The version is updated there (https://github.com/cloudevents/sdk-java/issues/588), but needs to be released. As soon as this is done, it can be updated here.

Is it advisable to use dependency overrides until then?

HKWinterhalter commented 10 months ago

It appears that only JsonFormat.CONTENT_TYPE is used here and therefore doesn't pertain to the CVE (custom deserialization methods). Otherwise I do think the correct place for this is requesting cloudevents java sdk to release a newer version.

jrmfg commented 3 months ago

https://github.com/GoogleCloudPlatform/functions-framework-java/pull/274 - cloudevents opted to roll this into the 3.0 release, so we have to bump the cloudevents-sdk version we require, too.