Skip to content

KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1#11962

Merged
cadonna merged 2 commits into
apache:trunkfrom
edwin092:edwin/KAFKA-13775
Mar 30, 2022
Merged

KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1#11962
cadonna merged 2 commits into
apache:trunkfrom
edwin092:edwin/KAFKA-13775

Conversation

@edwin092

@edwin092 edwin092 commented Mar 29, 2022

Copy link
Copy Markdown
Contributor

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Committer Checklist (excluded from commit message)

  • Verify design and implementation
  • Verify test coverage and CI build status
  • Verify documentation (including upgrade notes)

showuon
showuon approved these changes Mar 30, 2022
View reviewed changes

@showuon showuon left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for the PR. @cadonna , I think this fix should backport to 3.2. WDYT?

@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

@showuon I agree.

@edwin092 Could you also modify the LICENSE-binary file with the new version. It would be really helpful, if you could also update the other jackson versions there.

@edwin092

edwin092 commented Mar 30, 2022

Copy link
Copy Markdown
Contributor Author

@showuon I agree.

@edwin092 Could you also modify the LICENSE-binary file with the new version. It would be really helpful, if you could also update the other jackson versions there.

Sure! Done!

@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

@edwin092 Thanks!
You do justice to your profile picture! 🙂

cadonna
cadonna approved these changes Mar 30, 2022
View reviewed changes

@cadonna cadonna left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

Once the builds are good, I will merge the PR to trunk and cherry-pick it to 3.2.

@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

@tombentley Do you want to consider this PR for 3.1?

@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

Failures are unrelated

Build / JDK 8 and Scala 2.12 / kafka.network.DynamicConnectionQuotaTest.testDynamicListenerConnectionCreationRateQuota()
Build / JDK 11 and Scala 2.13 / kafka.server.KRaftClusterTest.testCreateClusterAndPerformReassignment()

@cadonna cadonna merged commit 76ca62a into apache:trunk Mar 30, 2022
cadonna pushed a commit that referenced this pull request Mar 30, 2022
@edwin092 @cadonna
KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (#…
a6e4260 
…11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

Cherry-picked to 3.2

cadonna pushed a commit that referenced this pull request Mar 30, 2022
@edwin092 @cadonna
KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (#…
f919d9d 
…11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

Cherry-picked to 3.1 \cc @tombentley

@cadonna

cadonna commented Mar 30, 2022

Copy link
Copy Markdown
Member

Thank you @edwin092 !

lmr3796 pushed a commit to lmr3796/kafka that referenced this pull request Mar 31, 2022
@edwin092 @lmr3796
[LI-CHERRY-PICK] Bump vulnerable jackson-databind
f0bffcf 
This should effectively purge LI commit
- [LI-HOTFIX] Update jackson-databind from vulnerable version (linkedin#317)

== Original upstream commit message ==

KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (apache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
@lmr3796 lmr3796 mentioned this pull request Mar 31, 2022
Merged
3 tasks
@edwin092 edwin092 deleted the edwin/KAFKA-13775 branch March 31, 2022 06:19
jjaakola-aiven pushed a commit to aiven/kafka that referenced this pull request Mar 31, 2022
@edwin092 @jjaakola-aiven
KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (a…
bc3bebd 
…pache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
jjaakola-aiven pushed a commit to aiven/kafka that referenced this pull request Mar 31, 2022
@edwin092 @jjaakola-aiven
KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (a…
bb3325e 
…pache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
jjaakola-aiven pushed a commit to aiven/kafka that referenced this pull request Mar 31, 2022
@edwin092 @jjaakola-aiven
KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (a…
cf9bae1 
…pache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
lmr3796 added a commit to linkedin/kafka that referenced this pull request Mar 31, 2022
@lmr3796 @edwin092
[LI-CHERRY-PICK] Bump vulnerable jackson-databind (#327)
d517469 
This should effectively purge LI commit
- [LI-HOTFIX] Update jackson-databind from vulnerable version (#317)

== Original upstream commit [76ca62a] ==

KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (apache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>

Co-authored-by: Edwin <edwinhobor@gmail.com>
@lmr3796 lmr3796 mentioned this pull request Mar 31, 2022
Merged
@efeg

efeg commented Apr 1, 2022

Copy link
Copy Markdown
Contributor

@tombentley @cadonna Based on https://cwiki.apache.org/confluence/display/KAFKA/Release+Plan+3.1.1 the release date is March or April. Are there any updates on when we can expect the release of 3.1.1 with this vulnerability fix?

jeffkbkim pushed a commit to confluentinc/kafka that referenced this pull request May 12, 2022
@edwin092 @jeffkbkim
KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (a…
f3fd622 
…pache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>
jeffkbkim added a commit to confluentinc/kafka that referenced this pull request May 12, 2022
@jeffkbkim
Merge remote-tracking branch 'apache-kafka/3.1' into 3.1-sync-ak-to-c…
e249b1b 
…cs-11-may-2022

* apache-kafka/3.1: (51 commits)
  MINOR: reload4j build dependency fixes (apache#12144)
  KAFKA-13255: Use config.properties.exclude when mirroring topics (apache#11401)
  KAFKA-13794: Fix comparator of inflightBatchesBySequence in TransactionsManager (round 3) (apache#12096)
  KAFKA-13794: Follow up to fix producer batch comparator (apache#12006)
  fix: make sliding window works without grace period (#kafka-13739) (apache#11980)
  3.1.1 release notes (apache#12001)
  KAFKA-13794; Fix comparator of `inflightBatchesBySequence` in `TransactionManager` (apache#11991)
  KAFKA-13782; Ensure correct partition added to txn after abort on full batch (apache#11995)
  KAFKA-13748: Do not include file stream connectors in Connect's CLASSPATH and plugin.path by default (apache#11908)
  KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (apache#11962)
  ...
lmr3796 added a commit to lmr3796/kafka that referenced this pull request Jun 2, 2022
@lmr3796 @edwin092
[LI-CHERRY-PICK] Bump vulnerable jackson-databind (linkedin#327)
40f6cb9 
This should effectively purge LI commit
- [LI-HOTFIX] Update jackson-databind from vulnerable version (linkedin#317)

== Original upstream commit [76ca62a] ==

KAFKA-13775: CVE-2020-36518 - Upgrade jackson-databind to 2.12.6.1 (apache#11962)

CVE-2020-36518 vulnerability affects jackson-databind (see GHSA-57j2-w4cx-62h2).

Upgrading to jackson-databind version 2.12.6.1 addresses this CVE.

Reviewers: Luke Chen <showuon@gmail.com>, Bruno Cadonna <cadonna@apache.org>

Co-authored-by: Edwin <edwinhobor@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cadonna cadonna cadonna approved these changes

@showuon showuon showuon approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@edwin092 @cadonna @efeg @showuon