Fixing databind version CVE

awslabs · Feb 22, 2021 · 398fbd4 · 398fbd4
1 parent ab8d6ce
commit 398fbd4
Show file tree

Hide file tree

Showing 12 changed files with 19 additions and 10 deletions.
diff --git a/.gitignore b/.gitignore
@@ -7,3 +7,8 @@ node/.idea/*
 python/dist/*
 python/aws_kinesis_agg.egg-info/*
 .*
+java/KinesisDeaggregator/.classpath
+java/.project
+java/KinesisDeaggregator/.classpath
+java/KinesisAggregator/.classpath
+java/.project
diff --git a/java/KinesisAggregator/.classpath b/java/KinesisAggregator/.classpath
@@ -20,6 +20,7 @@
 		<attributes>
 			<attribute name="optional" value="true"/>
 			<attribute name="maven.pomderived" value="true"/>
+			<attribute name="test" value="true"/>
 		</attributes>
 	</classpathentry>
 	<classpathentry kind="output" path="target/classes"/>

diff --git a/java/KinesisAggregator/dist/KinesisAggregator-1.1.3-complete.jar b/java/KinesisAggregator/dist/KinesisAggregator-1.1.3-complete.jar
diff --git a/java/KinesisAggregator/dist/amazon-kinesis-aggregator-1.1.3-javadoc.jar b/java/KinesisAggregator/dist/amazon-kinesis-aggregator-1.1.3-javadoc.jar
diff --git a/java/KinesisAggregator/dist/amazon-kinesis-aggregator-1.1.3-sources.jar b/java/KinesisAggregator/dist/amazon-kinesis-aggregator-1.1.3-sources.jar
diff --git a/java/KinesisAggregator/dist/amazon-kinesis-aggregator-1.1.3.jar b/java/KinesisAggregator/dist/amazon-kinesis-aggregator-1.1.3.jar
diff --git a/java/KinesisAggregator/pom.xml b/java/KinesisAggregator/pom.xml
@@ -8,7 +8,7 @@
 
 	<groupId>com.amazonaws</groupId>
 	<artifactId>amazon-kinesis-aggregator</artifactId>
-	<version>1.1.2</version>
+	<version>1.1.3</version>
 
 	<packaging>jar</packaging>
 
@@ -43,7 +43,7 @@
 	</developers>
 
 	<build>
-		<defaultGoal>clean compile</defaultGoal>
+		<defaultGoal>clean compile package assembly:assembly</defaultGoal>
 		<sourceDirectory>src/main/java</sourceDirectory>
 		<plugins>
 			<plugin>
@@ -131,42 +131,45 @@
 				</exclusion>
 			</exclusions>
 		</dependency>
-		
+
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-core</artifactId>
 			<version>2.10.2</version>
 		</dependency>
-		
+
 		<dependency>
 			<groupId>com.fasterxml.jackson.dataformat</groupId>
 			<artifactId>jackson-dataformat-cbor</artifactId>
 			<version>2.10.2</version>
 		</dependency>
-		
+
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-databind</artifactId>
-			<version>2.10.2</version>
+			<version>[2.10.5.1,)</version>
 		</dependency>
-		
+
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-lang3</artifactId>
 			<version>3.10</version>
 		</dependency>
+
 		<dependency>
 			<groupId>junit</groupId>
 			<artifactId>junit</artifactId>
 			<version>4.13.1</version>
 			<scope>test</scope>
 		</dependency>
+
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
 			<version>1.11</version>
 			<scope>test</scope>
 		</dependency>
+
 		<dependency>
 			<groupId>commons-logging</groupId>
 			<artifactId>commons-logging</artifactId>

diff --git a/java/KinesisAggregatorV2/dist/KinesisAggregator-2.0.3-complete.jar b/java/KinesisAggregatorV2/dist/KinesisAggregator-2.0.3-complete.jar
diff --git a/java/KinesisAggregatorV2/dist/amazon-kinesis-aggregator-2.0.3-javadoc.jar b/java/KinesisAggregatorV2/dist/amazon-kinesis-aggregator-2.0.3-javadoc.jar
diff --git a/java/KinesisAggregatorV2/dist/amazon-kinesis-aggregator-2.0.3-sources.jar b/java/KinesisAggregatorV2/dist/amazon-kinesis-aggregator-2.0.3-sources.jar
diff --git a/java/KinesisAggregatorV2/dist/amazon-kinesis-aggregator-2.0.3.jar b/java/KinesisAggregatorV2/dist/amazon-kinesis-aggregator-2.0.3.jar
diff --git a/java/KinesisAggregatorV2/pom.xml b/java/KinesisAggregatorV2/pom.xml
@@ -8,7 +8,7 @@
 
 	<groupId>com.amazonaws</groupId>
 	<artifactId>amazon-kinesis-aggregator</artifactId>
-	<version>2.0.2</version>
+	<version>2.0.3</version>
 
 	<packaging>jar</packaging>
 
@@ -43,7 +43,7 @@
 	</developers>
 
 	<build>
-		<defaultGoal>clean compile</defaultGoal>
+		<defaultGoal>clean compile package assembly:assembly</defaultGoal>
 		<sourceDirectory>src/main/java</sourceDirectory>
 		<plugins>
 			<plugin>
@@ -139,7 +139,7 @@
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-databind</artifactId>
-			<version>2.10.2</version>
+			<version>[2.10.5.1,)</version>
 		</dependency>
 
 		<dependency>