Details
-
Fix
-
Status: Released (View Workflow)
-
Minor
-
Resolution: Fixed
-
1.13.12, 2.2.3
-
None
-
None
-
CVE-2020-36518
Description
Current Situation
- Currently JOC Cockpit (JS1 and JS7), Agent (JS1 and JS7) and Master (JS1 only) make use of jackson-databind version 2.9.10.8.
- a vulnerability affect this version
Desired Behavior
- Due to a vulnerability Issue of older jackson-databind releases JOC Cockpit (JS1 and JS7), Agent (JS1 and JS7) and Master (JS1 only) should make use of the current version 2.13.2.1 that fixes the issue.
- Additionally jackson-core, jackson-annotations, jackson-module-jaxb-annotations and jackson-dataformat-xml have to be updated to version 2.13.2 also, as jackson-databind is not downward compatible to older versions of jackson-core.