Package
hadoop-fips-3.3.6
Component
jackson-databind
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
jackson-databind 2.3.3 is present in the bundled Maven repository only because jasmine-maven-plugin 2.1, which runs the YARN catalog webapp's JavaScript tests, depends on webjars-locator 0.29, which declares jackson-databind 2.3.3. It is not used by any Hadoop artifact: hadoop-project's dependencyManagement pins jackson-databind (jackson2.databind.version) for all Hadoop modules. This copy is only loaded inside a Maven build-plugin classloader, where its input is the consuming project's own build configuration, not attacker-controlled data.
Status
Justification
Impact
jackson-databind 2.3.3 is present in the bundled Maven repository only because jasmine-maven-plugin 2.1, which runs the YARN catalog webapp's JavaScript tests, depends on webjars-locator 0.29, which declares jackson-databind 2.3.3. It is not used by any Hadoop artifact: hadoop-project's dependencyManagement pins jackson-databind (jackson2.databind.version) for all Hadoop modules. This copy is only loaded inside a Maven build-plugin classloader, where its input is the consuming project's own build configuration, not attacker-controlled data.
Status