Lucene search

K
atlassianSecurity-metrics-botCWD-5903
HistoryJan 12, 2023 - 9:57 a.m.

Bump jackson-databind dependency to 2.13.4.2

2023-01-1209:57:47
security-metrics-bot
jira.atlassian.com
30

0.002 Low

EPSS

Percentile

60.1%

Embedded Crowd library has transitive dependency to vulnerable library
{code:java}
com.fasterxml.jackson.core:jackson-databind:jar:2.12.1 - CVE-2020-36518{code}
It is being included through Crowd dependency to {{com.microsoft.azure:msal4j:jar:1.11.0}}
The affected versions are before version 5.0.4.

Affected versions:

  • version < 5.0.4

Fixed versions:

  • 5.0.4