-
Enhancement
-
Resolution: Duplicate
-
Major
-
6.4.0.GA
-
None
JBoss EAP 6.4.7 is still shipping with old jackson libraries in $eap-6.4.7/modules/system/layers/base. EAP includes jackson 2.4.1, but the latest version of jackson is 2.8.0. And the versions are not cross-compatible, meaning an application that relies on a later version of the jackson libraries will throw class compatibility exceptions on startup, unless the libraries are manually updated.
Please upgrade the com.fasterxml.jackson libraries.
Or consider removing them from modules altogether. Having them in modules makes it more likely than not that they'll conflict with deployed applications that also rely on jackson.
- relates to
-
JBEAP-5195 Upgrade Jackson to 2.7.4 due to CVE-2016-3720
- Verified
-
WFLY-6713 Upgrade Jackson to 2.7.4 due to CVE-2016-3720
- Closed