Remove CVE-2023-39410 Vulnerability Due To jackson-mapper-asl
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 10
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
The logfast.core library seems to be now unmaintained (no release since 2015). Can it be removed or upgraded to another library? Alternatively the jackson-mapper-asl can possibly be excluded.
https://mvnrepository.com/artifact/org.codehaus.jackson/jackson-mapper-asl/1.9.13
https://mvnrepository.com/artifact/com.github.lafa.logfast/logfast.core/1.0.6
mvn dependency:tree -Dverbose -Dincludes=org.codehaus.jackson:jackson-mapper-asl
...
[INFO] - com.yahoo.tagchowder:tagchowder.core🫙2.0.27:compile
[INFO] - com.github.lafa.logfast:logfast.core🫙1.0.6:compile
[INFO] - org.apache.avro:avro🫙1.7.7:compile
[INFO] - org.codehaus.jackson:jackson-mapper-asl🫙1.9.13:compile
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the reported mvn dependency:tree -Dverbose -Dincludes=org.codehaus.jackson:jackson-mapper-asl command and inspect the logfast.core, tagchowder.core, and avro dependency chain. Done means the vulnerable jackson-mapper-asl dependency is no longer present, with the chosen removal, upgrade, or exclusion approach verified by the dependency tree.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100