linkedin / linkedin/parseq

Bump vulnerable dependency on jackson-mapper-asl (CVE-2019-10172)

Open
#321 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.2k
Forks
268
PR merge metrics
No merged PRs in 30d

Description

Parseq depends on jackson-mapper-asl, which has not been updated for many years and has been since deprecated, moved to jackson-databind under FastXML.

This library has a serious CVE that can only be addressed by migrating from jackson-mapper-asl to jackson-databind module at a later version (preferably [2.13.2.2](https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.13.2.2))

This ticket is for doing this migration with Parseq. Because Restli client depends on Parseq, this dependency bubbles up to anyone depending on Rest.li client as well.

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect Parseq's dependency declarations and usages of jackson-mapper-asl first, then run the existing test suite to identify migration impact. Done means Parseq uses jackson-databind at the requested later version and the vulnerable jackson-mapper-asl dependency no longer bubbles up to Rest.li clients.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.