commit 98794615f346c753a94fa5f63f7cbc67792af4c1
author Amichai Hemli <amichai.hemli@intl.att.com> Mon Sep 16 10:53:47 2019 +0300
committer Amichai Hemli <amichai.hemli@intl.att.com> Mon Sep 16 12:49:06 2019 +0300
tree d33cdb96d417d984988fe000dad22cf3b7eff6fd
parent 69ea8f5b4c5165b12de7261bfb19625c6dc3d5be

Upgrade FasterXML/Jackson to version 2.9.9.3

FasterXML jackson-databind versions 2.x through 2.9.9.1 are vulnerable.
we will use 2.9.9.3 for jackson-databind only
Issue-ID: VID-640

Signed-off-by: Amichai Hemli <amichai.hemli@intl.att.com>
Change-Id: I537cb83ad787522b75fdee59ffabb51def747096

epsdk-app-onap/pom.xml

diff --git a/epsdk-app-onap/pom.xml b/epsdk-app-onap/pom.xml
index 5cab377..f9b55f0 100755
--- a/epsdk-app-onap/pom.xml
+++ b/epsdk-app-onap/pom.xml
@@ -26,6 +26,7 @@
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <epsdk.version>2.5.0</epsdk.version>
         <jackson.version>2.9.9</jackson.version>
+        <jackson.databind.version>2.9.9.3</jackson.databind.version>
         <springframework.version>5.1.9.RELEASE</springframework.version>
         <!-- epsdk-core is importing this class, which is only on spring-orm 4 but not in orm 5:
          org.springframework.orm.hibernate4.HibernateTransactionManager
@@ -337,7 +338,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson.version}</version>
+            <version>${jackson.databind.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.module</groupId>