Upgrade jackson-databind package to >=2.16.0 version

Open Beginner friendly
#299 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
java
Domain
security

Research direction

Open the linked pom.xml entry around line 9 and inspect how amazon-kinesis-client uses jackson-databind version 2.13.5. Confirm the dependency can be upgraded to at least 2.16.0, then use the project's existing build checks to verify the change and its vulnerability resolution.

Written by the indexing model from the issue text.

Description

Description

Currently jackson-databind package used with version 2.13.5 by amazon-kinesis-client is having medium severity vulnerability.

https://ubuntu.com/security/CVE-2023-35116
https://nvd.nist.gov/vuln/detail/CVE-2023-35116

Vulnerability Description

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

Expected resolution

Upgrade jackson-databind package version to >=2.16.0 version https://github.com/awslabs/amazon-kinesis-client-python/blob/master/pom.xml#L9

Dominant language
Python
Stars
377
Forks
228
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from awslabs/amazon-kinesis-client-python

All issues in awslabs/amazon-kinesis-client-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.