Skip to content

Releasing 0.4.6 version
Compare
Choose a tag to compare
@vishwakarma vishwakarma released this 18 Oct 12:06
· 101 commits to master since this release
0.4.6
878c474

Upgrade jackson version to 2.9.7 due to security vulnerabilities.
details --

FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Assets 2
Loading