Dependency Vulnerability CVE-2022-42003 7.5

Walkyst / lavaplayer-fork

Apache License 2.0

173 stars 68 forks source link

Dependency Vulnerability CVE-2022-42003 7.5 #96

Closed kuflierl closed 7 months ago

kuflierl commented 1 year ago

CVE-2022-42003 7.5 Deserialization of Untrusted Data vulnerability pending CVSS allocation in com.fasterxml.jackson.core:jackson-databind:2.13.4 Please upgrade to a version >= 2.13.4.1

derfurkan commented 1 year ago

This issue should be reviewed ASAP!

freyacodes commented 1 year ago

Before anyone panics, it doesn't appear like Lavaplayer is affected. There are no mentions of UNWRAP_SINGLE_VALUE_ARRAYS in this repository, and I believe it is disabled by default

JamesKing95 commented 1 year ago

I believe #95 resolves this.