{"action":"opened","issue":{"url":"https://api.github.com/repos/cucumber/cucumber/issues/405","repository_url":"https://api.github.com/repos/cucumber/cucumber","labels_url":"https://api.github.com/repos/cucumber/cucumber/issues/405/labels{/name}","comments_url":"https://api.github.com/repos/cucumber/cucumber/issues/405/comments","events_url":"https://api.github.com/repos/cucumber/cucumber/issues/405/events","html_url":"https://github.com/cucumber/cucumber/issues/405","id":330075565,"node_id":"MDU6SXNzdWUzMzAwNzU1NjU=","number":405,"title":"datatable-dependencies: update jackson-databind to fix CVE-2017-17485","user":{"login":"kuehl","id":3269337,"node_id":"MDQ6VXNlcjMyNjkzMzc=","avatar_url":"https://avatars1.githubusercontent.com/u/3269337?v=4","gravatar_id":"","url":"https://api.github.com/users/kuehl","html_url":"https://github.com/kuehl","followers_url":"https://api.github.com/users/kuehl/followers","following_url":"https://api.github.com/users/kuehl/following{/other_user}","gists_url":"https://api.github.com/users/kuehl/gists{/gist_id}","starred_url":"https://api.github.com/users/kuehl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kuehl/subscriptions","organizations_url":"https://api.github.com/users/kuehl/orgs","repos_url":"https://api.github.com/users/kuehl/repos","events_url":"https://api.github.com/users/kuehl/events{/privacy}","received_events_url":"https://api.github.com/users/kuehl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-07T00:18:51Z","updated_at":"2018-06-07T00:18:51Z","closed_at":null,"author_association":"NONE","body":"## Summary\r\n\r\n[CVE-2017-17485](https://nvd.nist.gov/vuln/detail/CVE-2017-17485)\r\n\r\n> FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.\r\n<!--- Provide a general summary description of the issue -->\r\n\r\n## Expected Behavior\r\n\r\navoid known, publicly disclosed, vulnerabilities.\r\n\r\n## Current Behavior\r\n\r\n[OWASP Dependency-Check](https://www.owasp.org/index.php/OWASP_Dependency_Check) reports [CVE-2017-17485](https://nvd.nist.gov/vuln/detail/CVE-2017-17485)\r\n\r\n## Possible Solution\r\n\r\nupdate jackson-databind to 2.9.5 should fix CVE-2017-17485\r\n\r\n## Steps to Reproduce (for bugs)\r\n\r\n1. install your Freedom of choice - plugin/cli/ant [OWASP Dependency-Check](https://www.owasp.org/index.php/OWASP_Dependency_Check)\r\n2. scan applications and their dependent libraries\r\n3. view and fix Dependency-Check Report\r\n\r\n## Context & Motivation\r\n\r\nspring-clean, housekeeping... in short: make the world a better place :wink:\r\n\r\n## Your Environment\r\n\r\n* Version used: .gradle/caches/modules-2/files-2.1/io.cucumber/datatable-dependencies/1.1.2/587e171a23630e4f69cc872d42971e39880efe92/datatable-dependencies-1.1.2.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml and openjdk version \"1.8.0_171\" OpenJDK Runtime Environment (build 1.8.0_171-8u171-b11-0ubuntu0.16.04.1-b11)\r\nOpenJDK 64-Bit Server VM (build 25.171-b11, mixed mode)\r\n* Operating System and version: Linux kkuehl-pc 4.16.3-041603-generic #201804190730 SMP Thu Apr 19 07:32:02 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux\r\n"}}
{"actor":{"display_login":"kuehl"}}