Remove CVE-2023-39410 Vulnerability Due To jackson-mapper-asl
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by running the reported mvn dependency:tree -Dverbose -Dincludes=org.codehaus.jackson:jackson-mapper-asl command and inspect the logfast.core, tagchowder.core, and avro dependency chain. Done means the vulnerable jackson-mapper-asl dependency is no longer present, with the chosen removal, upgrade, or exclusion approach verified by the dependency tree.
Written by the indexing model from the issue text.
Description
The logfast.core library seems to be now unmaintained (no release since 2015). Can it be removed or upgraded to another library? Alternatively the jackson-mapper-asl can possibly be excluded.
https://mvnrepository.com/artifact/org.codehaus.jackson/jackson-mapper-asl/1.9.13
https://mvnrepository.com/artifact/com.github.lafa.logfast/logfast.core/1.0.6
mvn dependency:tree -Dverbose -Dincludes=org.codehaus.jackson:jackson-mapper-asl
...
[INFO] - com.yahoo.tagchowder:tagchowder.core🫙2.0.27:compile
[INFO] - com.github.lafa.logfast:logfast.core🫙1.0.6:compile
[INFO] - org.apache.avro:avro🫙1.7.7:compile
[INFO] - org.codehaus.jackson:jackson-mapper-asl🫙1.9.13:compile
- Dominant language
- Java
- Stars
- 10
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from yahoo/tagchowder
-
TagSoup 1.3Open
Difficulty 5/5 Over a week Newbie friendliness 15/100
yahoo/tagchowder#54 · 1 comment ·
-
Unused FieldOpen
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
yahoo/tagchowder#53 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
yahoo/tagchowder#52 ·
All issues in yahoo/tagchowder
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
objectionary/eo-graphs#80 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
enhancement good first issue
Difficulty 2/5 Half a day Newbie friendliness 66/100
apache/fineract-consumer-facing#175 ·
Maintainers usually reply within 1 day
-
[BUG] 订单：会员凭订单号即可取消其他会员的待付款订单（取消接口不校验订单归属）Possibly taken @dadiyang claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
macrozheng/mall#1016 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100