Update Jira REST Java Client for security

Question

Hi,

we are using the Jira REST Java Client (JRJC) in the newest version (5.2.1). Thanks for providing such an extensive client!

The client brings the dependency com.sun.jersey:jersey-client with it in version 1.19.

Jersey moved to a new group id: org.glassfish.jersey.core:jersey-client which is available in 2.31.

The problem with the com.sun.jersey:jersey-client is that it brings org.codehaus.jackson:jackson-mapper-asl (version 1.9.2) with it which has multiple vulnerabilities (CVE-2018-14718, CVE-2018-5968, CVE-2020-10673, CVE-2018-7489, CVE-2019-14540, CVE-2019-14893, CVE-2017-17485, CVE-2018-1000873).

Is there any chance you upgrade to a new version of jersey-client to fix these security incidents?

Thanks!
Sebastian

Robert Winterfeld · Answer

what is the current status of the request, unfortunately I cannot read it

Robert Winterfeld · Answer

what is the current status of the request, unfortunately I cannot read it

Debeka Support · Answer

Hi Sebastian,

I contacted the Atlassian support and they created an issue:

https://jira.atlassian.com/browse/JRASERVER-72920

Best regards

Alexander