From 7c3b40397d5b5922f7ac03d1153163011b988610 Mon Sep 17 00:00:00 2001
From: Ryan Lewis <ryan@rlew.io>
Date: Thu, 10 Nov 2022 08:01:34 +0000
Subject: Introduce jackson-databind constraint for 2.12.7.1 (#2733)

Fixes CVE-2022-42003
---
 core/build.gradle.kts | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'core')

diff --git a/core/build.gradle.kts b/core/build.gradle.kts
index 97b89976..41db29d3 100644
--- a/core/build.gradle.kts
+++ b/core/build.gradle.kts
@@ -15,6 +15,12 @@ dependencies {
     val jackson_version: String by project
     implementation("com.fasterxml.jackson.module:jackson-module-kotlin:$jackson_version")
     implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-xml:$jackson_version")
+    val jackson_databind_version: String by project
+    constraints {
+        implementation("com.fasterxml.jackson.core:jackson-databind:$jackson_databind_version") {
+            because("CVE-2022-42003")
+        }
+    }
 
     val coroutines_version: String by project
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:$coroutines_version")
-- 
cgit