CC-42331: Upgrade jackson-databind to 2.21.5 - #922
Open
Jainam Jain (jjain1259) wants to merge 1 commit into
Open
CC-42331: Upgrade jackson-databind to 2.21.5#922Jainam Jain (jjain1259) wants to merge 1 commit into
Jainam Jain (jjain1259) wants to merge 1 commit into
Conversation
Fixes CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515 (CC-42331). jackson-core and jackson-annotations are bumped alongside databind for consistency; jackson-annotations no longer follows patch-level versioning as of the 2.20 line, so it gets its own property. jackson-datatype-jsr310 (test scope only) is pinned to 2.21.4 since 2.21.5 isn't yet available via the internal artifact mirror; it is unaffected by these CVEs.
|
🎉 All Contributor License Agreements have been signed. Ready to merge. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
com.fasterxml.jackson.core:jackson-databindfrom2.18.6to2.21.5to fix multiple jackson-databind CVEsjackson-coreandjackson-annotationsare bumped alongsidedatabindfor version consistency;jackson-annotationsno longer follows patch-level versioning as of the 2.20 line, so it now tracks its ownjackson.annotations.versionpropertyjackson-datatype-jsr310(test scope only) is pinned to2.21.4because2.21.5is not yet available via the internal artifact mirror; it is unaffected by these CVEs since it's a test-only dependencyjackson.versionproperty inpom.xml(not shaded)CVE Details
kafka-connect-elasticsearch:14.1.7,kafka-connect-elasticsearch:15.1.2com.fasterxml.jackson.core:jackson-databind:2.18.6com.fasterxml.jackson.core:jackson-databind:2.21.5(viajackson.versionproperty bump inpom.xml)Test Results
Trivy CVE Scan
Command:
trivy rootfs --scanners vuln .Before (jackson-databind 2.18.6):
After (jackson-databind 2.21.5):
Result: CLEAN — 0 jackson-databind vulnerabilities detected (all four CVEs resolved)
Unit Tests — 0 tests, 0 failures (pre-existing, unchanged from base branch)
Command:
mvn testNote:
mvn testruns 0 tests on14.1.xbefore this change too (confirmed by diffing against base branch) — unit tests in this module live under the integration-test (failsafe) phase.Integration Tests — 25 tests, 0 failures, 4 pre-existing errors, 2 skipped (identical to base branch)
Command:
mvn verify -DskipIntegrationTests=false -Dtest=none -DfailIfNoTests=falseThe 4 errors are pre-existing local-environment Docker image pull failures (
ContainerFetch), confirmed identical (same 4 tests, same failure type) when run against the unmodified14.1.xbase branch — unrelated to this dependency bump.KDP Sink Test
Command:
playground run -f ./elasticsearch-sink.sh --connector-jar /path/to/kafka-connect-elasticsearch-14.1.8-SNAPSHOT.jar --environment plaintextAdditionally verified end-to-end via direct API checks: all 10 test records were correctly indexed into Elasticsearch (
GET /test-elasticsearch-sink/_count→{"count":10}), and the connector/task remained inRUNNINGstate throughout with no errors in the Connect logs.