我的项目背景: 应要求我的项目进行jar包降级,扫描到的jackson-mapper-asl-1.9.6.jar 具备高危破绽
CVE-2018-14718 ==> cve详情
形容: 2.9.7 之前的 FasterXML jackson-databind 2.x 可能容许近程攻击者通过利用失败来阻止 slf4j-ext 类进行多态反序列化来执行任意代码。
以后我的项目应用的依赖是jackson-mapper-asl-1.9.6.jar
查阅mvnrepository官网依赖 可知 其最新的更新版本是1.9.13 而上文提到的是 jackson-databaind 两者artifactId 都对应不上,揣测jackson-mapper-asl 迁徙到了 jackson-databaind.
关上jackson-mapper-asl的mvn官网地址 发现的确曾经迁徙到了jackson-databind
此时咱们只须要剔除jackson-mapper-asl的依赖,并退出迁徙后的指定版本的依赖即可:
<!-- https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind --><dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.13.0</version></dependency>而用idea去在我的项目中查问时却并未发现jackson-mapper-asl,那他是怎么引进来的呢,持续摸索发现:
我的项目中引入了jackson-jaxrs,而他依赖于jackson-mapper-asl;
于是点开jackson-jaxrs mvn地址 发现它也前移到了 jackson-jaxrs-json-provider
查看最新版本援用的jackson-databind版本 发现是想要的
间接在我的项目中引入即可
<dependency> <groupId>com.fasterxml.jackson.jaxrs</groupId> <artifactId>jackson-jaxrs-json-provider</artifactId> <version>2.13.0</version> </dependency>最初启动我的项目发现报错:
21:29:36.854 - WARN [org.springframework.boot.context.embedded.AnnotationConfigEmbeddedWebApplicationContext:551] - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'sessionManage': Cannot create inner bean 'org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider#6f74669c' of type [org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider] while setting bean property 'providers' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider#6f74669c': Failed to introspect bean class [org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider] for lookup method metadata: could not find class that it depends on; nested exception is java.lang.NoClassDefFoundError: org/codehaus/jackson/map/JsonMappingException21:29:36.866 - ERROR [org.springframework.boot.SpringApplication:771] - Application startup failedorg.springframework.beans.factory.BeanCreationException: Error creating bean with name 'sessionManage': Cannot create inner bean 'org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider#6f74669c' of type [org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider] while setting bean property 'providers' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider#6f74669c': Failed to introspect bean class [org.codehaus.jackson.jaxrs.JacksonJaxbJsonProvider] for lookup method metadata: could not find class that it depends on; nested exception is java.lang.NoClassDefFoundError: org/codehaus/jackson/map/JsonMappingException at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)点开对应的配置文件,是配置的javaBean找不到了
联想到jackson-databind迁徙当前权限定类名的扭转
关上jackson-databind的包 找到对应的JacksonJaxbJsonProvider类的全限定类名 复制粘贴替换即可