Aws-sdk-java: Request to update jackson version to avoid Jackson Deserializer security vulnerability
Please look at https://github.com/FasterXML/jackson-databind/issues/1599 and the fix has been e.g. included in 2.7.9.1 release. Not sure if security issue happen with the functionalities AWS SDK provides. But AWS SDK client apps that depend on Jackson could want to use the new version(they might use version 2.6.6 come from AWS SDK).
DaichiUeura
All 3 comments
We have to maintain backwards compatibility with Java 6 and thus we can't upgrade to Jackson 2.7+. Customers running on JDK 7+ can safely switch out to use Jackson 2.7+.
spfink
on 11 May 2017
FYI in the original issue's thread @cowtowncoder mentioned that jackson-databind v2.6.7.1 has been released to target it for Jackson's v2.6.* users
skrzyneckik
on 16 May 2018
@skrzyneckik, not sure if that was a request or just a statement, but we do already depend on 2.6.7.1
spfink
on 16 May 2018
Related issues
neil-rubens
路
5Comments
umangs9
路
3Comments
Yeggstry
路
3Comments
martinth
路
4Comments
pgoranss
路
5Comments
Most helpful comment
We have to maintain backwards compatibility with Java 6 and thus we can't upgrade to Jackson 2.7+. Customers running on JDK 7+ can safely switch out to use Jackson 2.7+.