Details
-
Fix
-
Status: Released (View Workflow)
-
Minor
-
Resolution: Fixed
-
1.12.10, 1.13.0
-
None
-
CVE-2019-16335, CVE-2019-14540
Description
Current Situation
- Currently JOC Cockpit and JobScheduler use Jackson Databind version 2.9.9.2.
- A vulnerability affects this version, see https://www.cvedetails.com/cve/CVE-2019-16335/ and https://www.cvedetails.com/cve/CVE-2019-14540/
Desired Behavior
- Due to a vulnerability Issue of older Jackson releases the JOC Cockpit as well as the JobScheduler should use the current version 2.9.10 that fixes the issues.