Skip to content

Commit 913f97f

Browse files
Dwayne BaileyDwayne Bailey
Dwayne Bailey
authored and
Dwayne Bailey
committed
Bump springboot from 1.15.14 to 1.15.19
This indirectly upgrades jackson-databind to 2.8.11.3 which resolves the selected version for a number of dependencies. Although reporting an error this release fixes: CVE-2018-14718: RCE with slf4j-ext jar CVE-2018-14719: RCE with blaze-ds-opt, -core jars CVE-2018-14720: exfiltration/XXE with only JDK classes (some JDK versions) CVE-2018-14721: exfiltration/SSRF with axis2-jaxws Ref FasterXML/jackson-databind#2097 CVE-2018-19360 (axis2-transport-jms) CVE-2018-19361 (openjpa) CVE-2018-19362 (jboss-common-core) Ref FasterXML/jackson-databind#2186 See FasterXML/jackson-databind#2097 (comment) https://github.com/FasterXML/jackson-databind/blob/2.8/release-notes/VERSION#L8-L15 RDM-3796
1 parent 808fb87 commit 913f97f

File tree

2 files changed

+29
-15
lines changed

2 files changed

+29
-15
lines changed

build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ buildscript {
1313
plugins {
1414
id 'application'
1515
id 'io.spring.dependency-management' version '1.0.6.RELEASE'
16-
id 'org.springframework.boot' version '1.5.14.RELEASE'
16+
id 'org.springframework.boot' version '1.5.19.RELEASE'
1717
id 'com.github.ben-manes.versions' version '0.20.0'
1818
id 'org.sonarqube' version '2.6.2'
1919
id 'jacoco'

dependency-check-suppressions.xml

+28-14
Original file line numberDiff line numberDiff line change
@@ -75,38 +75,52 @@
7575
<cpe>cpe:/a:slf4j:slf4j:1.7.25</cpe>
7676
</suppress>
7777
<suppress>
78-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
79-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
78+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
79+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
80+
and RDM-3796</notes>
81+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
8082
<cve>CVE-2018-14718</cve>
8183
</suppress>
8284
<suppress>
83-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
84-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
85+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
86+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
87+
and RDM-3796</notes>
88+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
8589
<cve>CVE-2018-14719</cve>
8690
</suppress>
8791
<suppress>
88-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
89-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
92+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
93+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
94+
and RDM-3796</notes>
95+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
9096
<cve>CVE-2018-14720</cve>
9197
</suppress>
9298
<suppress>
93-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
94-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
99+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
100+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
101+
and RDM-3796</notes>
102+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
95103
<cve>CVE-2018-14721</cve>
96104
</suppress>
97105
<suppress>
98-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
99-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
106+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
107+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
108+
and RDM-3796</notes>
109+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
100110
<cve>CVE-2018-19360</cve>
101111
</suppress>
102112
<suppress>
103-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
104-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
113+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
114+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
115+
and RDM-3796</notes>
116+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
105117
<cve>CVE-2018-19361</cve>
106118
</suppress>
107119
<suppress>
108-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
109-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
120+
<notes>jackson-databind 2.8.11.3 fixes this CVE. See
121+
https://github.com/FasterXML/jackson-databind/issues/2097#issuecomment-457071680
122+
and RDM-3796</notes>
123+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
110124
<cve>CVE-2018-19362</cve>
111125
</suppress>
112126
<suppress>

0 commit comments

Comments
 (0)