Package
opensearch-2-security-analytics
Component
jackson-databind
Latest update
Fixed version
2.19.6-r15
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
2.19.6-r15Status
Impact
The affected jackson-databind 2.17.1 classes are shaded into security-analytics-commons 1.0.0, a prebuilt jar that the upstream security-analytics plugin vendors in its source tree and consumes as a binary artifact. Upstream does not publish that artifact to a public repository and has not updated it on its main or 2.19 branches, so the shaded copy cannot be rebuilt against a fixed jackson-databind until upstream ships an updated jar.
Status