This message was deleted.

Throw in a newer version and hope that it works? Or check whether 8.0 will have a newer version and wait for it?

latest version 7.6 has the vulnerability. I really cant wait for gradle 8

So? Did you try what I suggested?

I'm not sure I understand. This is: • a resource exhaustion vuln • under certain circumstances (deserializating JSON, unwrapping single-element arrays) We have no idea whether Gradle is actually vulnerable (you could search the codebase for how jackson is being used), and a Gradle build has so many more ways to cause a resource exhaustion that rejecting a Gradle installation for that is BS. Vulnerability scanning is about awareness leading to investigations to determine whether you're actually vulnerable or not (in which case you just ignore the warning). Blindly blocking without escape hatch is BS.

It is, but it is often caused by compliance or whatever and not worth discussing, trying to convince. 😉

precisely.. im not going to convince devops folks.. compliance.. they dont like that jar there.. i dont get my app online... i was able to fix by doing this wget https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.13.4/jackson-databind-2.13.4.jar mv jackson-databind-2.13.4.jar /opt/gradle/gradle-7.6/lib/plugins/jackson-databind-2.13.3.jar