topic Re: Databricks-jdbc and vulnerabilities CVE-2022-42004, CVE-2022-42003 in Data Engineering

Databricks-jdbc and vulnerabilities CVE-2022-42004, CVE-2022-42003

Lars_J — Fri, 07 Oct 2022 21:04:38 GMT

The latest version of Databricks-jdbc available through Maven (2.6.29) now has these two vulnerabilities:

All due to depending on and including in the jar the library jackson-databind 2.13.2.2.

Is there a possibility to have a new updated version of Databricks-jdbc that uses jackson 2.14.0-rc1? (the currently only jackson-databind version that passes the two vulnerability checks above)

We are currently using the databricks-jdbc driver in an environment where we can only get an exception for this that lasts a short time.

Also - If databricks-jdbc was available in thin form on Maven, we would be able to fix it ourselves. Is that possible to do?

Thanks! - Lars

Re: Databricks-jdbc and vulnerabilities CVE-2022-42004, CVE-2022-42003

Hubert-Dudek — Sun, 16 Oct 2022 10:26:17 GMT

I think you need to contact support or your sales representative from Databricks.

Re: Databricks-jdbc and vulnerabilities CVE-2022-42004, CVE-2022-42003

Anonymous — Thu, 17 Nov 2022 05:06:46 GMT

Hi @Lars Joreteg

Does @Hubert Dudek response answer your question? If yes, would you be happy to mark it as best so that other members can find the solution more quickly?

We'd love to hear from you.

Thanks!