Jackson dependency causes OWASP alerts. Change to Jackson version 2.7.4

[emartinezs44]

OWASP Validation obtains the following vulnerabilities for dependences:

Vulnerable Dependencies
CVE CWE Severity (CVSS)↑ Dependency
CVE-2016-3720 High (10.0) jackson-annotations-2.6.0.jar
CVE-2016-3720 High (10.0) jackson-core-2.6.7.jar
CVE-2016-3720 High (10.0) jackson-databind-2.6.7.jar
CVE-2016-3720 High (10.0) jackson-datatype-guava-2.6.7.jar
CVE-2016-3720 High (10.0) jackson-jaxrs-base-2.6.7.jar
CVE-2016-3720 High (10.0) jackson-jaxrs-json-provider-2.6.7.jar
CVE-2016-3720 High (10.0) jackson-module-jaxb-annotations-2.6.7.jar

This vulnerability is fixed in jackson 2.7.4:

FasterXML/jackson-dataformat-xml#190

This dependency should be updated to avoid alerts in OWASP checking.

[KostyaSha]

Does docker-client use xml at all?

[mattnworb]

@KostyaSha no, it does not.

[brettcave]

OWASP checks still fail on 2.7.4 and 2.8.0, e.g.

CVE-2016-3720       High (10.0)     com.fasterxml.jackson.core.jackson-core-2.7.4.jar    
           com.fasterxml.jackson.core.jackson-annotations-2.7.4.jar
           com.fasterxml.jackson.core.jackson-databind-2.7.4.jar
           com.fasterxml.jackson.datatype.jackson-datatype-joda-2.7.4.jar
           com.fasterxml.jackson.module.jackson-module-paranamer-2.7.4.jar
           com.fasterxml.jackson.module.jackson-module-scala_2.10-2.7.4.jar

The warning was added to the CVE database by downstream fedora issue, being tracked at https://bugzilla.redhat.com/show_activity.cgi?id=1328427 - the CVE database needs to be updated.

[KostyaSha]

So why do you care about XmlMapper? It also possible to change dependency version on project level.

[brettcave]

Even the jackson-core check will fail, pulled in by the jackson-databind dependency - so will not pass even with xml exclusion rules.

[mattnworb]

@brettcave so upgrading to 2.7.4 or 2.8.0 or any other Jackson version won't resolve those warnings yet?

[brettcave]

@mattnworb correct. Can be easily verified as follows:

1. Copy a jackson lib into "testlib" - have done this for jackson-core 2.7.4, 2.7.5 and 2.8.0.
2. Download OWASP dependency check from https://www.owasp.org/index.php/OWASP_Dependency_Check ("Command line" link on right nav bar will down the archive) and extract it.
3. Run the dependency check in the bin directory from extracted archive - .sh for Linux .bat for Windows: ./dependency-check.sh --disableAssembly --format ALL --project Jackson --scan path/to/testlib/*
4. Open dependency-check-vulernability.html in the directory you ran it from.