📦 Bump versions of multiple dependencies to address vulnerabilities#5
Open
softforgeinc wants to merge 2 commits intomainfrom
Open
📦 Bump versions of multiple dependencies to address vulnerabilities#5softforgeinc wants to merge 2 commits intomainfrom
softforgeinc wants to merge 2 commits intomainfrom
Conversation
added 2 commits
October 1, 2025 03:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lineaje has automatically created this pull request to resolve the following CVEs:
Data Processor. jackson-databind allows a Java stack overflow
exception and denial of service via a large depth of nested
objects.
2.13.x before 2.13.4.2 resource exhaustion can occur because
of a lack of a check in primitive value deserializers to
avoid deep wrapper array nesting, when the
UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. This was
patched in 2.12.7.1, 2.13.4.2, and 2.14.0. Commits that
introduced vulnerable code are
FasterXML/jackson-databind@d499f2e,
FasterXML/jackson-databind@0e37a39,
and
FasterXML/jackson-databind@7ba9ac5.
Fix commits are
FasterXML/jackson-databind@cd09097
and
FasterXML/jackson-databind@d78d00e.
The
2.13.4.1release does fix this issue, however it alsoreferences a non-existent jackson-bom which causes build
failures for gradle users. See
FasterXML/jackson-databind#3627 (comment)
for details. This is fixed in
2.13.4.2which is listed inthe advisory metadata so that users are not subjected to
unnecessary build failures
before 2.13.4, resource exhaustion can occur because of a
lack of a check in BeanDeserializer._deserializeFromArray to
prevent use of deeply nested arrays. This issue can only
happen when the
UNWRAP_SINGLE_VALUE_ARRAYSfeature isexplicitly enabled.
2.13.x before 2.13.1 allows attackers to cause a denial of
service (2 GB transient heap usage per read) in uncommon
situations involving JsonNode JDK serialization.
improper authorization
You can merge this PR once the tests pass and the changes are reviewed.
Thank you for reviewing the update! 🚀