Upgrade jackson-databind package to >=2.16.0 version
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
Research direction
Open the linked pom.xml entry around line 9 and inspect how amazon-kinesis-client uses jackson-databind version 2.13.5. Confirm the dependency can be upgraded to at least 2.16.0, then use the project's existing build checks to verify the change and its vulnerability resolution.
Written by the indexing model from the issue text.
Description
Description
Currently jackson-databind package used with version 2.13.5 by amazon-kinesis-client is having medium severity vulnerability.
https://ubuntu.com/security/CVE-2023-35116
https://nvd.nist.gov/vuln/detail/CVE-2023-35116
Vulnerability Description
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
Expected resolution
Upgrade jackson-databind package version to >=2.16.0 version https://github.com/awslabs/amazon-kinesis-client-python/blob/master/pom.xml#L9
- Dominant language
- Python
- Stars
- 377
- Forks
- 228
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from awslabs/amazon-kinesis-client-python
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
awslabs/amazon-kinesis-client-python#346 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
All issues in awslabs/amazon-kinesis-client-python
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100