Repository navigation
Bump Aliyun OSS Java SDK version #11029
Description
We are currently using 3.3.0 which has a dependency on jersey-json-1.9 which in turn uses jackson-xc-1.9.x and jackson-jaxrs-1.9.x. These jackson-xc-1.9.x and jackson-jaxrs-1.9.x has a known security vulnerabilities reported in CVE-2018-14718 and CVE-2018-7489. The latest version (3.11.3) seem no longer using jersey-json-1.9.
Activity
jihoonson commentedon Mar 24, 2021
@FrankChen021 could you please test the druid extension against the latest sdk version?
FrankChen021 commentedon Mar 24, 2021
I will test it before March 31, is that OK?
jihoonson commentedon Mar 24, 2021
@FrankChen021 It sounds good to me. Thank you!
FrankChen021 commentedon Mar 25, 2021
I checked the latest version 3.11.3, it indeed has no dependency on jersey-json. I will test if the latest version works when I'm free :)