Update jackson-databind re: CVE-2019-12814

FusionAuth · Jul 23, 2019 · c23de28 · c23de28
1 parent b213d35
commit c23de28
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 4 deletions.
diff --git a/CHANGES b/CHANGES
@@ -1,5 +1,9 @@
 FusionAuth JWT Changes
 
+
+Changes in 3.1.2
+ * Upgraded Jackson Databind to 2.9.9.1. This upgrade addresses CVE-2019-12814.
+
 Changes in 3.1.1
 
  * Add .equals(), .hashCode() and .toString() to io.fusionauth.jwt.domain.Header

diff --git a/build.savant b/build.savant
@@ -17,7 +17,7 @@
 savantVersion = "1.0.0"
 jacksonVersion = "2.9.9"
 
-project(group: "io.fusionauth", name: "fusionauth-jwt", version: "3.1.1", licenses: ["ApacheV2_0"]) {
+project(group: "io.fusionauth", name: "fusionauth-jwt", version: "3.1.2", licenses: ["ApacheV2_0"]) {
 
   workflow {
     standard()
@@ -30,7 +30,7 @@ project(group: "io.fusionauth", name: "fusionauth-jwt", version: "3.1.1", licens
   dependencies {
     group(name: "compile") {
       dependency(id: "com.fasterxml.jackson.core:jackson-core:${jacksonVersion}")
-      dependency(id: "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}")
+      dependency(id: "com.fasterxml.jackson.core:jackson-databind:2.9.10+2.9.9.1")
       dependency(id: "com.fasterxml.jackson.core:jackson-annotations:${jacksonVersion}")
     }
     group(name: "test-compile", export: false) {

diff --git a/pom.xml b/pom.xml
@@ -6,7 +6,7 @@
 
   <groupId>io.fusionauth</groupId>
   <artifactId>fusionauth-jwt</artifactId>
-  <version>3.1.1</version>
+  <version>3.1.2</version>
   <packaging>jar</packaging>
 
   <name>FusionAuth JWT</name>
@@ -65,7 +65,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.9.9</version>
+      <version>2.9.9.1</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>