Jackson-Databind 漏洞修复

发布于 2025-01-17 14:36:42 字数 1748 浏览 0 评论 0原文

任何人是否使用修复程序更新了他们的应用程序，以解决Jackson-Databind 2.12.6脆弱性错误。它已修复在V 2.13.12.1中，但是当我更新Gradle以引用此最新库时，我会遇到另一个依赖项错误，而Gradle无法下载它。如果您有其他选择，请协助。

构建错误是

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':compileJava'.
> Could not resolve all files for configuration ':compileClasspath'.
   > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Required by:
         project : > com.fasterxml.jackson.core:jackson-databind:2.13.2.1
      > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
         > Could not get resource 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'.
            > Could not GET 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'. Received status code 503 from server: Service Unavailable
   > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Required by:
         project : > com.fasterxml.jackson.core:jackson-annotations:2.13.2
         project : > com.fasterxml.jackson.core:jackson-core:2.13.2
      > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
         > Could not get resource 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'.
            > Could not GET 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'. Received status code 503 from server: Service Unavailable

原文

Did any one updated their application with a fix to the jackson-databind 2.12.6 vulerability error. Its fixed in v 2.13.12.1, but when I update my gradle to refer to this latest library, I get another dependency error, which my gradle isn't able to download it. Please assist if you have any alternatives.

The build error is

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':compileJava'.
> Could not resolve all files for configuration ':compileClasspath'.
   > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Required by:
         project : > com.fasterxml.jackson.core:jackson-databind:2.13.2.1
      > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
         > Could not get resource 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'.
            > Could not GET 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'. Received status code 503 from server: Service Unavailable
   > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
     Required by:
         project : > com.fasterxml.jackson.core:jackson-annotations:2.13.2
         project : > com.fasterxml.jackson.core:jackson-core:2.13.2
      > Could not resolve com.fasterxml.jackson:jackson-bom:2.13.2.1.
         > Could not get resource 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'.
            > Could not GET 'https://internalreporsitoryhost:8443/repository/maven-jaspersoft-3rd-party-ce/com/fasterxml/jackson/jackson-bom/2.13.2.1/jackson-bom-2.13.2.1.pom'. Received status code 503 from server: Service Unavailable

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

绾颜 2025-01-24 14:36:42

您可以使用类似的依赖性约束：

def jackson_version = '2.13.2'
def jackson_databind_version = '2.13.2.1'

constraints {
    compile("com.fasterxml.jackson:jackson-bom") {
        version {
            strictly jackson_version
        }
        because 'previous versions are vulnerable to CVE-2020-36518'
    }
    compile("com.fasterxml.jackson.core:jackson-databind") {
        version {
            require jackson_databind_version
        }
        because 'previous versions are vulnerable to CVE-2020-36518'
    }
}

请参阅

这应该迫使Gradle使用旧版本的Jackson-Bom/Core和Jackson Databind的新版本/固定版本。

You can use dependency constraints like this:

def jackson_version = '2.13.2'
def jackson_databind_version = '2.13.2.1'

constraints {
    compile("com.fasterxml.jackson:jackson-bom") {
        version {
            strictly jackson_version
        }
        because 'previous versions are vulnerable to CVE-2020-36518'
    }
    compile("com.fasterxml.jackson.core:jackson-databind") {
        version {
            require jackson_databind_version
        }
        because 'previous versions are vulnerable to CVE-2020-36518'
    }
}

See https://docs.gradle.org/current/userguide/rich_versions.html#sec:strict-version for details.

This should force gradle to use the older version of jackson-bom/core and the newer/fixed version of jackson databind.

回复收藏 0 原文