Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: jackson-databind version upgrade to remediate security vulnerabilities #9528

Open
ZachChuba opened this issue Nov 13, 2024 · 1 comment
Labels

Comments

@ZachChuba
Copy link

Module

Core

Testcontainers version

1.20.3

Using the latest Testcontainers version?

Yes

Host OS

Osx

Host Arch

amd64

Docker version

docker version
Client:
 Version:           26.1.4
 API version:       1.45
 Go version:        go1.21.11
 Git commit:        5650f9b
 Built:             Wed Jun  5 11:26:02 2024
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.31.0 (153195)
 Engine:
  Version:          26.1.4
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.11
  Git commit:       de5c9cf
  Built:            Wed Jun  5 11:29:12 2024
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.6.33
  GitCommit:        d2d58213f83a351ca8f528a95fbd145f5654e957
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

What happened?

jackson-databind is vulnerable to CVE-2017-7525 which is patched with version 2.8.9 FasterXML/jackson-databind#1599. Please upgrade to version 2.8.9 in the next release. Enterprises may blacklist test-containers due to the presence of this vulnerability. Also note issue: #9289 should be addressed in the next major release as well.

Relevant log output

Additional Information

No response

@shanjare2002
Copy link

Hey can i do this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants