functions-framework-java icon indicating copy to clipboard operation
functions-framework-java copied to clipboard

Published 20 hours ago • verified publisher icon GoogleCloudPlatform

CVE-2022-42004: Transitive dependency (jackson) from io.cloudevents:cloudevents-json-jackson vulnerable

Open stummb opened this issue 1 year ago • 2 comments

jackson-json is included transitively via cloudevents-json-jackson. The included version is vulnerable (CVE-2022-42004).

The version is updated there (https://github.com/cloudevents/sdk-java/issues/588), but needs to be released. As soon as this is done, it can be updated here.

Is it advisable to use dependency overrides until then?

stummb avatar Oct 09 '23 10:10 stummb