Critical Vulnerability in jackson-databind version

structurizr / cli

A command line utility for Structurizr.

https://docs.structurizr.com/cli

Apache License 2.0

492 stars 75 forks source link

Closed Franco0700 closed 1 year ago

Franco0700 commented 1 year ago

gradle using an old version of jackson-databind. I found the vulnerability using trivy.

Library: com.fasterxml.jackson.core:jackson-databind (jackson-databind-2.13.4.1.jar) Severity: HIGH Vuln: CVE-2022-42003

simonbrowndotje commented 1 year ago

This has been resolved upstream and will be reflected in the next release. That said, jackson-*:2.14.1 has a different HIGH vulnerability.