search

apache / beam

Apache Beam is a unified programming model for Batch and Streaming data processing.
https://beam.apache.org/
Apache License 2.0
7.76k stars 4.21k forks source link

Get rid of jackson to avoid the continuous flow of CVEs in Jackson #19707

Open damccorm opened 2 years ago

damccorm commented 2 years ago

Jackson keeps having CVE on all releases of databind and transitively beam sdk java core has CVE on all its releases (for the record, when writing this issue you must use at least jackson-databind 2.9.9.2 but last week it was 2.9.9.1 and 2.14 didn't get the fix).

Can be neat to get rid of jackson which does not fix this issue for a very long time now and just use JSON-B or another JSON impl to ensure the CVE is not usable because beam is there.

Imported from Jira BEAM-7881. Original Jira may contain additional context. Reported by: romain.manni-bucau.

cowtowncoder commented 2 years ago

FWTW Jackson 2.10.x and later are not vulnerable to this class of CVEs so this particular problem is no longer relevant.