Package
wso2is
Component
jackson-databind
Latest update
Fixed version
7.3.0-r5
Aliases
6.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
7.3.0-r5Status
Previous location
/usr/share/java/wso2is/repository/components/plugins/com.fasterxml.jackson.core.jackson-databind_2.18.6.jarNew location
/usr/share/java/wso2is/repository/components/plugins/com.fasterxml.jackson.core.jackson-databind_2.18.8.jarImpact
version-only path change detected during APK rebuild
Status
Impact
The affected jars are prebuilt WSO2 artifacts, not resolved by the product-is Maven build: plugins/ jars are OSGi bundles installed from WSO2 p2 feature repositories, lib/ jars are copied from the prebuilt carbon kernel distribution, and the hazelcast and solr orbit bundles repackage the vulnerable classes internally. Maven version overrides cannot reach them. Remediation requires WSO2 to rebuild and release the affected orbit bundles and p2 features.
Status