Package
spark-3.5-scala-2.13
Component
jackson-databind
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The bundled hadoop-client-runtime-3.3.6.jar contains a relocated (shaded) copy of jackson-databind 2.12.7.1 that is affected by GHSA-wjgm-6hv5-3cvf; it is fixed in 2.18.10 on the 2.18 line. Because the classes are shaded inside the Apache Hadoop client jar, the version cannot be raised independently. The newest upstream hadoop-client-runtime releases still shade jackson 2.12.7 (3.4.1 through 3.4.3) or 2.18.6 (3.5.0), both below the fixed version, so remediation is pending an upstream Hadoop release that shades jackson 2.18.10 or later.
Status