embulk / embulk/embulk-input-jdbc
Security update of jackson-databind library of embulk-input-postgresql to 2.13
Open
- Dominant language
- Java
- Stars
- 106
- Forks
- 76
- PR merge metrics
- No merged PRs in 30d
Description
If we check https://github.com/embulk/embulk-input-jdbc/blob/master/embulk-input-postgresql/gradle/dependency-locks/compileClasspath.lockfile we can see that jackson-databind is in version 2.6.7 but this version has some security vulnerabilities and needs to be upgraded:
CWE-502: Deserialization of Untrusted Data
CWE-184: Incomplete List of Disallowed Inputs
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24616
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.