SonaType Security Issue Due to jackson-core #4287
Labels
status: declined
Features that we don't intend to implement or Bug reports that are invalid or missing enough details
type: task
Comments
LarryBullock
added
status: waiting-for-triage
fmbenhassine
added a commit
that referenced
this issue
Feb 13, 2023
Are you sure Jackson 2.14.1 is coming as a transitive dependency from Spring Batch? Because Spring Batch 4.3.x depends on Jackson 2.11.4: https://github.com/spring-projects/spring-batch/blob/4.3.x/build.gradle#L79 .
For v5, Jackson is an optional dependency (see migration guide), and you can include the version you want when you import it in your project. But for our own build, I have updated the version to 2.14.2. |
fmbenhassine
added
status: waiting-for-reporter
|
Attaching a screen shot from IQ server showing the dependency tree that we are working with. The issue is showing for 2.14.2,
|
|
I don't know which tool your IQ server is using the analyze dependencies, but maven's dependency plugin is giving another result. Here is a quick example:
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.example</groupId>
<artifactId>gh4287</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>gh4287</name>
<dependencies>
<dependency>
<groupId>org.springframework.batch</groupId>
<artifactId>spring-batch-core</artifactId>
<version>4.3.7</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.10.1</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
</configuration>
</plugin>
</plugins>
</build>
</project>
package com.example.demo;
import org.springframework.batch.core.Job;
import org.springframework.batch.core.JobParameters;
import org.springframework.batch.core.configuration.annotation.EnableBatchProcessing;
import org.springframework.batch.core.configuration.annotation.JobBuilderFactory;
import org.springframework.batch.core.configuration.annotation.StepBuilderFactory;
import org.springframework.batch.core.launch.JobLauncher;
import org.springframework.batch.repeat.RepeatStatus;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
@EnableBatchProcessing
public class MyJobConfig {
@Bean
public Job job(JobBuilderFactory jobs, StepBuilderFactory steps) {
return jobs.get("job")
.start(steps.get("step")
.tasklet((contribution, chunkContext) -> {
System.out.println("Hello World!");
return RepeatStatus.FINISHED;
})
.build())
.build();
}
public static void main(String[] args) throws Exception {
ApplicationContext context = new AnnotationConfigApplicationContext(MyJobConfig.class);
JobLauncher jobLauncher = context.getBean(JobLauncher.class);
Job job = context.getBean(Job.class);
jobLauncher.run(job, new JobParameters());
}
}Here is the output of the command: If you add the There is no jackson 2.14.2 in the dependency tree above. Do you confirm? |
|
I see what you are presenting, and I have no idea how IQ Server gathers the data. I was simply sharing the information that was shared via the Jackson-core post that they plan to fix it the finding in 2.15 (likely to be resolved next month). End result is that if IQ server is not reporting properly, we need to get it fixed so that Spring Batch is not reporting an issue or we will not be allowed to deploy code. |
Thank you for your feedback. Based on that, I will close this issue. |
fmbenhassine
added
status: declined
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug description
IQ Server is reporting a transitive dependency issue for Spring-Batch 4.3.7 due to a transitive dependency on jackson-core 2.14.1. Since 2.14.1 is the latest version of jackson-core, I'm sure that this would be for even the current Spring-Batch version.
Just want to get this on the backlog to update jackson-core when they release the correction.
Environment
We are currently using spring-batch 4.3.7 and deploying to Java 8.
Steps to reproduce
Build a project where the outputs are scanned by IQ Server.
Expected behavior
No transitive security finding for jackson-core.
The text was updated successfully, but these errors were encountered: