Skip to content

[close #567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518#584

Merged
zz-jason merged 2 commits intotikv:masterfrom
iosmanthus:upgrade-jackson-databind
Apr 7, 2022
Merged

[close #567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518#584
zz-jason merged 2 commits intotikv:masterfrom
iosmanthus:upgrade-jackson-databind

Conversation

@iosmanthus
Copy link
Copy Markdown
Member

@iosmanthus iosmanthus commented Apr 7, 2022

Signed-off-by: iosmanthus myosmanthustree@gmail.com

What problem does this PR solve?

Issue Number: close #567

Problem Description:

upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518

What is changed and how does it work?

Related changes

  • Need to cherry-pick the release branch
  • Need to update the documentation
  • Need to be included in the release note
  • NO related changes

@iosmanthus
fix CVE-2020-36518
703bafd 
Signed-off-by: iosmanthus <myosmanthustree@gmail.com>
zz-jason
zz-jason approved these changes Apr 7, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@zz-jason zz-jason left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2022 •
edited
Loading

Codecov Report

Merging #584 (2d8385c) into master (56d64ef) will decrease coverage by 0.21%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master     #584      +/-   ##
============================================
- Coverage     34.08%   33.87%   -0.22%     
+ Complexity     1360     1359       -1     
============================================
  Files           270      270              
  Lines         17131    17131              
  Branches       1950     1950              
============================================
- Hits           5839     5803      -36     
- Misses        10680    10716      +36     
  Partials        612      612
Impacted Files Coverage Δ
...rc/main/java/io/grpc/netty/NettyClientHandler.java 57.54% <0.00%> (-5.82%) ⬇️
src/main/java/io/grpc/stub/ClientCalls.java 48.51% <0.00%> (-1.99%) ⬇️
...va/org/tikv/common/region/StoreHealthyChecker.java 73.07% <0.00%> (-1.29%) ⬇️
...ty/handler/codec/http2/Http2ConnectionHandler.java 51.58% <0.00%> (-0.49%) ⬇️
src/main/java/org/tikv/common/PDClient.java 59.47% <0.00%> (-0.48%) ⬇️
src/main/java/org/tikv/common/TiSession.java 70.95% <0.00%> (-0.48%) ⬇️
src/main/java/io/grpc/netty/WriteQueue.java 76.69% <0.00%> (+2.25%) ⬆️
...g/tikv/common/operation/iterator/ScanIterator.java 76.31% <0.00%> (+2.63%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 56d64ef...2d8385c. Read the comment docs.

@zz-jason zz-jason enabled auto-merge (squash) April 7, 2022 09:00
marsishandsome
marsishandsome approved these changes Apr 7, 2022
View reviewed changes
Copy link
Copy Markdown
Collaborator

@marsishandsome marsishandsome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@zz-jason zz-jason merged commit 7fa24c3 into tikv:master Apr 7, 2022
ti-srebot pushed a commit to ti-srebot/client-java that referenced this pull request Apr 7, 2022
@iosmanthus @ti-srebot
cherry pick tikv#584 to release-3.1
ae81d8d 
Signed-off-by: ti-srebot <ti-srebot@pingcap.com>
@ti-srebot ti-srebot mentioned this pull request Apr 7, 2022
Merged
@ti-srebot
Copy link
Copy Markdown
Collaborator

ti-srebot commented Apr 7, 2022

cherry pick to release-3.1 in PR #585

ti-srebot pushed a commit to ti-srebot/client-java that referenced this pull request Apr 7, 2022
@iosmanthus @ti-srebot
cherry pick tikv#584 to release-3.2
cd26c3c 
Signed-off-by: ti-srebot <ti-srebot@pingcap.com>
@ti-srebot ti-srebot mentioned this pull request Apr 7, 2022
Merged
@ti-srebot
Copy link
Copy Markdown
Collaborator

ti-srebot commented Apr 7, 2022

cherry pick to release-3.2 in PR #586

zz-jason pushed a commit that referenced this pull request Apr 7, 2022
@ti-srebot @iosmanthus
[close #567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518…
d0a3218 
… (#584) (#585)

Co-authored-by: iosmanthus <dengliming@pingcap.com>
Co-authored-by: iosmanthus <myosmanthustree@gmail.com>
zz-jason pushed a commit that referenced this pull request Apr 8, 2022
@ti-srebot @iosmanthus
[close #567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518…
058ba27 
… (#584) (#586)

Co-authored-by: iosmanthus <dengliming@pingcap.com>
iosmanthus added a commit that referenced this pull request Apr 8, 2022
@ti-srebot @iosmanthus
[close #567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518…
b54d6c0 
… (#584) (#585)

Co-authored-by: iosmanthus <dengliming@pingcap.com>
Co-authored-by: iosmanthus <myosmanthustree@gmail.com>
iosmanthus added a commit to iosmanthus/client-java that referenced this pull request May 30, 2022
@iosmanthus
[close tikv#567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020…
67ca6bf 
…-36518 (tikv#584)

Signed-off-by: iosmanthus <myosmanthustree@gmail.com>
sunxiaoguang pushed a commit that referenced this pull request May 30, 2022
@iosmanthus
[close #567] upgrade jackson-databind to 2.13.2.2 to fix CVE-2020-36518…
fed0826 
… (#584) (#605)

Signed-off-by: iosmanthus <myosmanthustree@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marsishandsome marsishandsome marsishandsome approved these changes

@ti-srebot ti-srebot ti-srebot approved these changes

+1 more reviewer

@zz-jason zz-jason zz-jason approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

status/LGT2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

update jackson-databind to fix CVE-2020-36518

4 participants

@iosmanthus @ti-srebot @zz-jason @marsishandsome