Dependencycheck: More Jackson CVE-2016-7051 false-positives

Created on 8 Jul 2017  路  3Comments  路  Source: jeremylong/DependencyCheck

(This is a follow-up of #751. Opened a new issue because that ticket has been closed and the fix released.)

Reports about CVE-2016-7051 should also be suppressed for the following maven GAVs:

  • All modules with groupId com.fasterxml.jackson.datatype.
  • All modules with groupId com.fasterxml.jackson.module.
  • All modules with groupId com.fasterxml.jackson.dataformat, except the one with artifactId jackson-dataformat-xml.
  • Module com.fasterxml.jackson.dataformat:jackson-dataformat-xml with versions 2.7.x and 2.8.y for x >= 8 and y >= 4.
FP Report bug
Source
picture Stephan202

Most helpful comment

Working on a patch to the suppression file.

picture jeremylong on 13 Jul 2017
👍2

All 3 comments

Also ignore all modules with groupId com.fasterxml.jackson.jaxrs please.

jowiho picture jowiho on 10 Jul 2017

Working on a patch to the suppression file.

jeremylong picture jeremylong on 13 Jul 2017
👍2

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

lock[bot] picture lock[bot] on 28 Sep 2018
Was this page helpful?
0 / 5 - 0 ratings

Related issues

tediroca picture tediroca  路  3Comments
gwsu2008 picture gwsu2008  路  3Comments
chadlwilson picture chadlwilson  路  3Comments
dwvisser picture dwvisser  路  4Comments
amandel picture amandel  路  3Comments