logo标签列表

Jackson-databind漏洞修复

javaspringsecuritygradlejackson-databind
3

有人更新了他们的应用程序以修复jackson-databind 2.12.6漏洞错误吗？它在v 2.13.12.1中得到了修复，但是当我更新我的gradle以引用这个最新库时，我遇到了另一个依赖错误，我的gradle无法下载它。如果您有任何替代方案，请协助解决。

构建错误为：

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':compileJava'.
> Could not resolve all files for configuration ':compileClasspath'.
   > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Required by:
         project : > com.fasterxml.jackson.core:jackson-databind:2.13.2.1
      > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
         > Could not get resource 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'.
            > Could not GET 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'. Received status code 503 from server: Service Unavailable
   > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Required by:
         project : > com.fasterxml.jackson.core:jackson-annotations:2.13.2
         project : > com.fasterxml.jackson.core:jackson-core:2.13.2
      > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
         > Could not get resource 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'.
            > Could not GET 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'. Received status code 503 from server: Service Unavailable
2个回答
1
您可以像这样使用依赖约束：
def jackson_version = '2.13.2'
def jackson_databind_version = '2.13.2.1'

constraints {
    compile("com.fasterxml.jackson:jackson-bom") {
        version {
            strictly jackson_version
        }
        because 'previous versions are vulnerable to CVE-2020-36518'
    }
    compile("com.fasterxml.jackson.core:jackson-databind") {
        version {
            require jackson_databind_version
        }
        because 'previous versions are vulnerable to CVE-2020-36518'
    }
}

请查看https://docs.gradle.org/current/userguide/rich_versions.html#sec:strict-version了解详情。这将强制gradle使用旧版的jackson-bom/core和新版/修复版的jackson databind。
能否只升级jacksonDatabind到2.13.2.2，同时保留所有其他依赖项使用旧版本2.12.6？ - Eslam Hamdy
其他依赖项包括jacksonAnnotations、jacksonDataformatCsv、jacksonModuleScala、jacksonJDK8Datatypes和jacksonJaxrsJsonProvider。 - Eslam Hamdy
@EslamHamdy 不确定但可以尝试，如果是这种情况，您需要将 jackson_version 设置为 2.12.6，将 jackson_databind 设置为上面给出的更新版本。 - msung
1
网页内容由stack overflow 提供, 点击上面的
可以查看英文原文，
原文链接