CVE-2019-12814 related to com.fasterxml.jackson.core:jackson-databind about spring-cloud-connectors

[scottfrederick]

See #297

[scottfrederick]

@tremblaysimon Please note that this project is in maintenance mode, in favor of the newer Java CFEnv project. We will continue to make this type of security-related changes, but releases will be fewer and further between.

[tremblaysimon]

Thank you for the information I will check that project.

[tremblaysimon]

@scottfrederick Do you know if it is possible for you to release a new version of spring-cloud-connectors with #297 since it's merged (and fixed).

In the meantime, I will ask our teams to migrate to new Java CFEnv library as soon as they can. Do you know if the migration guide from spring cloud connectors to Java CFEnv exists somewhere (mentionned in the blog post you shared to me) ?

[scottfrederick]

We haven't published a migration guide yet. For apps using Connectors, it is very simple (most of the migration guide will address Connectors extension libs).

• Replace dependencies on Connectors libraries (via direct dependencies like org.springframework.cloud:spring-cloud-cloudfoundry-connector or the Boot starter org.springframework.boot:spring-boot-starter-cloud-connectors) with a dependency on the appropriate Java CFEnv libs
• Remove any code that customizes the connections created by Connectors and replace with the appropriate Boot auto-configuration properties