com.fasterxml.jackson.core_jackson-core version 2.14.1 has several vulnerabilites - Githubissues

allure-framework / allure-java

Allure integrations for Java test frameworks

Apache License 2.0

341 stars 218 forks source link

com.fasterxml.jackson.core_jackson-core version 2.14.1 has several vulnerabilites #1037

Open fjgarciao opened 2 months ago

fjgarciao commented 2 months ago

What happened?

Hi all, Current jackson version embedded in allure-java-commons has several vulnerabilities:

https://github.com/FasterXML/jackson-core/pull/827 (high)
https://nvd.nist.gov/vuln/detail/CVE-2023-35116 (medium)

Could it be possible to upgrade to jackson-bom:2.17.0?

What Allure Integration are you using?

allure-java-commons

What version of Allure Integration you are using?

2.27.0

What version of Allure Report you are using?

2.27.0

Code of Conduct

[X] I agree to follow this project's Code of Conduct