3 ms·
Not arguing, but since this news article is a specific link to the Debian Security tracker - the package is `libjackson2-databind-java` on Debian, presumably si
by gravitas 7y ago
Not arguing, but since this news article is a specific link to the Debian Security tracker - the package is `libjackson2-databind-java` on Debian, presumably similar on others. If it was installed via package manager, `dpkg -l | grep jackson`, `rpm -qa | grep jackson` or similar on most Linux to possibly find it. I agree though that it's common for libraries like this to end up inside warballs.
- cipherboy 7y agojackson-databind is the name of the package on Fedora and on RHEL. We addressed this issue last week by updating to 2.10, though I think F30 and F31 updates still needs karma [0]. The other jackson packages are mostly Java package hierarchy that don't affect this CVE (jackson-core, jackson-bom, jackson-parent, and jackson-annotations -- but we've also updated all of these to 2.10 on F30+). So: rpm -qa | grep jackson-databind To the GGP: As noted by other commenters just having the package isn't sufficient. You need a number of other libraries (most of which aren't shipped with Fedora, none of which are shipped on RHEL) on the classpath of the running JVM. If you're not running any Java code, you're definitely not affected. If you're using any code distributed through the official channels, it is very unlikely that you're affected. You'll probably only be affected if you're using third-party projects. Which as always, are run at your own risk. :) [0]: Source: co-maintainer of the package via the Fedora Stewardship SIG. F30 Bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2019-b171554877 https://bodhi.fedoraproject.org/updates/FEDORA-2019-b1715548... F31 Bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2019-cf87377f5f https://bodhi.fedoraproject.org/updates/FEDORA-2019-cf87377f...