Package
druid
Component
jackson-databind
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The Druid Parquet extension includes the Apache Parquet parquet-jackson 1.18.1 jar, which bundles its own shaded copy of Jackson 2.22.2. That shaded copy cannot be upgraded separately from the jar. Parquet has moved its bundled Jackson to 2.22.3 on its main branch, but 1.18.1 is still the latest release. This will be remediated when Parquet publishes a release that includes the updated Jackson.
Status
Previous location
/usr/share/java/druid/extensions/druid-parquet-extensions/parquet-jackson-1.16.0.jarNew location
/usr/share/java/druid/extensions/druid-parquet-extensions/parquet-jackson-1.18.1.jarImpact
version-only path change detected during APK rebuild
Status