http://coldfusion.com logo
Join Slack
Powered by
Anybody know if there's a way and/or how to remove...
# cfml-general
j
Anybody know if there's a way and/or how to remove 
com.fasterxml.jackson.core:jackson-databind
from the Lucee docker images? I tried out the light build, which unlike the normal build appears to not include this in 
/opt/lucee/server/lucee-server/bundle
but my ECR image scan is still flagging numerous critical vulnerabilites coming from that package (like 30+) Edit: Was able to determine this comes from Commandbox (
root/.CommandBox/engine/cfml/cli/lucee-server/bundles/org.lucee.ehcache-2.10.3.jar
)
b
@Jason Ryan If you're on the latest version of CommandBox, can you please enter a ticket into the Lucee bug tracker with the list of vulnerabilities and hopefully they will update it in the next version
There's not really a way to override a core Lucee OSGI bundle
Even if you delete it from disk, it will re-extract it from the lucee.jar
And even if you remove it from the Lucee jar, it will download it
And even if you disable downloading, it will blow up because the Lucee core presumable requires that exact specific version
j
Gotcha. Thanks for the info.
b
👍 There's nothing you can really do then other than create some noise on the ticket. cc/ @zackster
That ticket should probably get some priority since it's going to prevent people from being able to use Lucee who are subject to any sort of security scanning process
s
Jackson is awful for CVEs -- we had to work really hard at work to migrate off older versions (2.8.x to 2.9.0 was a breaking change in Jackson) and it required changes to our frontend code as well as our backend code 😞 We try to make sure to use non-Jackson JSON libraries as much as possible these days.
(and everything depends on a version of Jackson in the Java world -- it is ubiquitous)
2 Views
Open in Slack
PreviousNext
Powered by