{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-java/issues/801","repository_url":"https://api.github.com/repos/aws/aws-sdk-java","labels_url":"https://api.github.com/repos/aws/aws-sdk-java/issues/801/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-java/issues/801/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-java/issues/801/events","html_url":"https://github.com/aws/aws-sdk-java/issues/801","id":169150510,"number":801,"title":"Jackson <= 2.7.3 has a known security vulnerability","user":{"login":"asieira","id":3287067,"avatar_url":"https://avatars.githubusercontent.com/u/3287067?v=3","gravatar_id":"","url":"https://api.github.com/users/asieira","html_url":"https://github.com/asieira","followers_url":"https://api.github.com/users/asieira/followers","following_url":"https://api.github.com/users/asieira/following{/other_user}","gists_url":"https://api.github.com/users/asieira/gists{/gist_id}","starred_url":"https://api.github.com/users/asieira/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asieira/subscriptions","organizations_url":"https://api.github.com/users/asieira/orgs","repos_url":"https://api.github.com/users/asieira/repos","events_url":"https://api.github.com/users/asieira/events{/privacy}","received_events_url":"https://api.github.com/users/asieira/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-03T14:49:18Z","updated_at":"2016-08-03T15:22:32Z","closed_at":"2016-08-03T15:22:31Z","body":"The SDK uses Jackson maven dependencies at version 2.6.6, which is vulnerable as per https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3720.\r\n\r\nPlease upgrade this dependency to version 2.7.4 or above to get the [fix](https://github.com/FasterXML/jackson-dataformat-xml/issues/199).\r\n\r\nPlus, in order to ensure that vulnerable dependencies are not used in the future, I would strongly recommend you use http://jeremylong.github.io/DependencyCheck/ to check this automatically and fail builds if vulnerable dependencies with a CVSS score above 8 are found."},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-java/issues/comments/237270675","html_url":"https://github.com/aws/aws-sdk-java/issues/801#issuecomment-237270675","issue_url":"https://api.github.com/repos/aws/aws-sdk-java/issues/801","id":237270675,"user":{"login":"asieira","id":3287067,"avatar_url":"https://avatars.githubusercontent.com/u/3287067?v=3","gravatar_id":"","url":"https://api.github.com/users/asieira","html_url":"https://github.com/asieira","followers_url":"https://api.github.com/users/asieira/followers","following_url":"https://api.github.com/users/asieira/following{/other_user}","gists_url":"https://api.github.com/users/asieira/gists{/gist_id}","starred_url":"https://api.github.com/users/asieira/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asieira/subscriptions","organizations_url":"https://api.github.com/users/asieira/orgs","repos_url":"https://api.github.com/users/asieira/repos","events_url":"https://api.github.com/users/asieira/events{/privacy}","received_events_url":"https://api.github.com/users/asieira/received_events","type":"User","site_admin":false},"created_at":"2016-08-03T15:22:31Z","updated_at":"2016-08-03T15:22:31Z","body":"Actually, this only affects jackson-dataformat-xml which is not used by the AWS SDK, and the detection was a false positive by DependencyCheck as per https://github.com/jeremylong/DependencyCheck/issues/517 and https://github.com/jeremylong/DependencyCheck/issues/535.\r\n\r\nSorry about this, closing the issue now."}}
{"actor":{"display_login":"asieira"}}