awslabs / awslabs/amazon-kinesis-client-python

Upgrade jackson-databind package to >=2.16.0 version

Open
#299 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
377
Forks
228
PR merge metrics
No merged PRs in 30d

Description

## Description

Currently `jackson-databind` package used with version `2.13.5` by amazon-kinesis-client is having medium severity vulnerability.

https://ubuntu.com/security/CVE-2023-35116
https://nvd.nist.gov/vuln/detail/CVE-2023-35116

## Vulnerability Description

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

## Expected resolution

Upgrade `jackson-databind` package version to >=2.16.0 version https://github.com/awslabs/amazon-kinesis-client-python/blob/master/pom.xml#L9

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.