dropbox/dropbox-sdk-java

Known vulnerability with current version of the Jackson library

Skullper opened this issue · 4 comments

Skullper commented

My project cannot be approved by security team because of the known vulnerability with the Jackson library version used in dropbox sdk.
The problem with WRITE_BIGDECIMAL_AS_PLAIN setting. If this setting is enabled the Jackson will attempt to write out the whole number, no matter how large the exponent. The following sample code will trigger an out of memory exception:

ObjectMapper mapper = new ObjectMapper().enable(JsonGenerator.Feature.WRITE_BIGDECIMAL_AS_PLAIN);
mapper.writeValueAsString(new java.math.BigDecimal("9.223372E+1010671858"));

I'm not sure if your sdk using this setting, but there is no guarantees that it won't used in future. The recommendation from security team was to update the Jackson library to 2.7.7 or higher.

Can I hope that jackson library will be updated in later releases of the sdk?

greg-db commented

Thanks for letting us know! I can't make any promises myself, but I'm raising this with the team to see if we can get that dependency version raised.

  • 👍1
greg-db commented

Good news, we've bumped that dependency version, so that change should be in the next release.

  • 🎉1
  • 🚀1
Skullper commented

@greg-db I'm grateful for such a quick response. Will be waiting patiently for a new release

greg-db commented

The updated dependency is now included in the new release v5.2.0.

  • 🎉1