Skip to content

[Feature Request] Bump jackson dependency due to possible CVE #882

Closed
#887
Closed
[Feature Request] Bump jackson dependency due to possible CVE#882
#887
Assignees
Avery-Dunn
Labels
BugSomething isn't working, needs an investigation and a fixP2Normal priority items, should be done after P1confidential-clientFor issues related to confidential client apps
Milestone
1.18.0
@bgavrilMS

Description

@bgavrilMS
bgavrilMS
opened on Nov 27, 2024

MSAL client type

Public, Confidential, Managed identity

Problem Statement

See FasterXML/jackson-databind#3972 for details. While it is disputed, it is being taken into account by some compliance tools. Better to just upgrade.

Applicability to MSAL is very low, as MSAL only parses JSON that comes from the identity provider.

Proposed solution

Bump jackson-databind from 2.13.4.2 to 2.18.1 or higher

Alternatives

No response

Metadata

Metadata

Assignees

Labels

BugSomething isn't working, needs an investigation and a fixP2Normal priority items, should be done after P1confidential-clientFor issues related to confidential client apps

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions