testcontainers
[Enhancement]: Update jackson databind version (support more than 50 containers in compose file)
Module
Core
Proposal
Currently the project is using Jackson databind yaml 2.8.x, and the comments on that part of the code say that this is for backwards compatibility.
Unfortunately that version uses an older version of snake yaml (1.17). This version has a known arbitrary code execution vulnerability, and it also fails to parse yaml that has >50 attributes, so it does not support more than 50 containers in a docker compose file.
jackson databind 2.8.x also has its own known vulnerabilitie: 1, 2.
I do not know what the compatibility issues the comment is referring to, but I think it's best to move to a newer version of jackson databind, even if it requires a new minor/major version.
testcontainers-core build.gradle:
configurations.all {
resolutionStrategy {
// use lower Jackson version
force 'com.fasterxml.jackson.core:jackson-databind:2.8.8'
force 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.8.8'
}
}
Jackson-databind 2.8.8 should be updated. It has 54 CVEs. Even though testcontainers should run in the test scope
Direct vulnerabilities:
- CVE-2022-42004
- CVE-2022-42003
- CVE-2021-20190
- CVE-2020-9548
- CVE-2020-9547
- CVE-2020-8840
- CVE-2020-36518
- CVE-2020-36189
- CVE-2020-36188
- CVE-2020-36187
- CVE-2020-36186
- CVE-2020-36185
- CVE-2020-36184
- CVE-2020-36183
- CVE-2020-36182
- CVE-2020-36181
- CVE-2020-36180
- CVE-2020-36179
- CVE-2020-35728
- CVE-2020-35491
- CVE-2020-35490
- CVE-2020-25649
- CVE-2020-24750
- CVE-2020-24616
- CVE-2020-10673
- CVE-2020-10650
- CVE-2019-20330
- CVE-2019-17531
- CVE-2019-17267
- CVE-2019-16943
- CVE-2019-16942
- CVE-2019-16335
- CVE-2019-14892
- CVE-2019-14540
- CVE-2019-14439
- CVE-2019-14379
- CVE-2019-12814
- CVE-2019-12384
- CVE-2019-12086
- CVE-2018-7489
- CVE-2018-5968
- CVE-2018-19362
- CVE-2018-19361
- CVE-2018-19360
- CVE-2018-14721
- CVE-2018-14720
- CVE-2018-14719
- CVE-2018-14718
- CVE-2018-12023
- CVE-2018-12022
- CVE-2018-11307
- CVE-2017-7525
- CVE-2017-17485
- CVE-2017-15095
Vulnerabilities from dependencies:
- CVE-2020-15250
