d43235c5cf
Move Jackson-databind to 2.13.2 ( #2548 )
...
Resolves CVE-2020-36518
Signed-off-by: Peter Nied <petern@amazon.com>
2022-03-21 18:44:13 -05:00
98efeba4e3
Bump maxmind-db from 1.3.1 to 2.0.0 in /modules/ingest-geoip ( #2123 )
...
* Bump maxmind-db from 1.3.1 to 2.0.0 in /modules/ingest-geoip
Bumps [maxmind-db](https://github.com/maxmind/MaxMind-DB-Reader-java ) from 1.3.1 to 2.0.0.
- [Release notes](https://github.com/maxmind/MaxMind-DB-Reader-java/releases )
- [Changelog](https://github.com/maxmind/MaxMind-DB-Reader-java/blob/main/CHANGELOG.md )
- [Commits](https://github.com/maxmind/MaxMind-DB-Reader-java/compare/v1.3.1...v2.0.0 )
---
updated-dependencies:
- dependency-name: com.maxmind.db:maxmind-db
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Updating SHAs
Signed-off-by: dependabot[bot] <support@github.com>
* Fixing failing precommit and check
Signed-off-by: Vacha Shah <vachshah@amazon.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <dependabot[bot]@users.noreply.github.com>
Co-authored-by: Vacha Shah <vachshah@amazon.com>
2022-02-23 17:07:02 -08:00
1568407c36
Upgrading Jackson-Databind version ( #1982 )
...
* Upgrading Jackson-Databind version
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
* Adding jackson-databind version using getProperty method
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
2022-01-26 20:44:22 -08:00
cdbc84f09d
Update Jackson to 2.12.5 ( #1247 )
...
Signed-off-by: Andriy Redko <andriy.redko@aiven.io>
2021-09-21 18:33:20 -04:00
50abf6d066
[CVE] Upgrade dependencies to mitigate CVEs ( #657 )
...
This PR upgrade the following dependencies to fix CVEs.
- commons-codec:1.12 (->1.13) apache/commons-codec@48b6157
- ant:1.10.8 (->1.10.9) https://ant.apache.org/security.html
- jackson-databind:2.10.4 (->2.11.0) FasterXML/jackson-databind#2589
- jackson-dataformat-cbor:2.10.4 (->2.11.0) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28491
- apache-httpclient:4.5.10 (->4.5.13) https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956
- checkstyle:8.20 (->8.29) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10782
- junit:4.12 (->4.13.1) https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp
- netty:4.1.49.Final (->4.1.59) https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2
Signed-off-by: Rabi Panda <adnapibar@gmail.com>
2021-05-18 11:37:24 -07:00
33669c0420
Upgrade to Jackson 2.10.4 ( #56188 )
...
Another Jackson release is available. There are some CVEs addressed,
none of which impact us, but since we can now bump Jackson easily, let
us move along with the train to avoid the false positives from security
scanners.
2020-05-06 17:20:23 -04:00
5c472fcb47
Upgrade jackson to 2.10.3 and GeoIP to 2.13.1 ( #53642 )
...
Re-applies the change from #53523 along with test fixes.
closes #53626
closes #53624
closes #53622
closes #53625
Co-authored-by: Nik Everett <nik9000@gmail.com>
Co-authored-by: Lee Hinman <dakrone@users.noreply.github.com>
Co-authored-by: Jake Landis <jake.landis@elastic.co>
2020-03-17 10:28:51 -07:00
2f0aca992b
Revert "Upgrade to Jackson 2.10.3 and GeoIP2 to 2.13.1 ( #53576 )"
...
This reverts commit b7dbadeea0
2020-03-15 18:10:40 -07:00
b7dbadeea0
Upgrade to Jackson 2.10.3 and GeoIP2 to 2.13.1 ( #53576 )
...
This commit upgrades our Jackson dependency to 2.10.3 and our GeoIP2
dependency to 2.13.1.
Relates #53523
2020-03-14 13:28:06 -04:00
32dd852210
Update jackson-databind to 2.8.11.6 ( #53522 )
...
This commit upgrades the jackson-databind depdendency to
2.8.11.6. Additionally, we revert a previous change that put
ingest-geoip on the version of jackson-databind from the version
properties file. This is because upgrading ingest-geoip to a later
version of jackson-databind also requires an upgrade to the geoip2
dependency which is currently blocked. Therefore, if we can get to a
point where we otherwise upgrade our Jackson dependencies, we do not
want ingest-geoip to automatically come along with it.
2020-03-12 20:15:13 -04:00
1c5a139968
Update jackson-databind to 2.8.11.4 ( #49347 ) ( #49937 )
2019-12-06 13:39:33 -06:00
751c05eff9
Bump jackson-databind version for ingest-geoip ( #39182 )
...
This commit bumps the jackson-databind version for ingest-geoip to
2.8.11.3.
2019-02-20 11:40:31 -05:00
e1717df0ac
Package ingest-geoip as a module ( #36898 )
...
This commit moves ingest-geoip from being a plugin to being a module
that is packaged with Elasticsearch distributions.
2018-12-22 07:21:49 -05:00
Peter Nied
dependabot[bot]
Rishikesh Pasham
Andriy Redko
Rabi Panda
Jason Tedor
Ryan Ernst
Mark Vieira
Jake Landis