#27040 Jackson FasterXML Update to 2.13.4

enhancement

major

#26644

Kafka and TL-Sync should use an exponential backoff in case of problems

minor

#26966

Configuring StorageMapping on PrimitiveStorage

#27006

Add tooltip description for LoginMessage interval attribute.

#27008

Enable tooltips via tabs

#27011

Update Maven Sources plugin to version 3.3.0

#27024

Support for multi-file upload in declarative forms

defect

major

#26930

Long values lead to unusable column filters

#26968

Missing items in refetch update event

minor

#26970

Wrong DB configuration at replay after changing FastList table

#26989

Broken GWT Launch Config

#26993

Application monitor uses wrong locale for displaying working memory values

#27012

Potential NullPointerException with Drag&Drop

#27021

Missing search buttons in Modern theme

#27022

Cyclic FileSystemProvider dependency in Log4J2

#27025

Inconsistent font type and size for number fields

#27026

Creating company contact: Half of the values are not saved

#27030

SafeHTML not started during automatic data migration

#27031

Missing adaptation of the stored model in model changing EventRewriter

#27032

Unexpected order of backup log files with Log4j2

#27036

The ThemeImage "NoIcon" does not disappear, but is displayed as an empty white image

#27039

Administration: Contact cleanup produces error message

#27040

Jackson FasterXML Update to 2.13.4

#27043

Batik update to 1.16

#27045

Maintenance page ScanData.jsp does not compile in openJDK 1.8

defect

minor

#27040

Jackson FasterXML Update to 2.13.4

SecurityIssue

Currently, version 2.13.2 of the Jackson FasterXML library is in use.

This version contains a security vulnerability:

In FasterXML jackson-databind versions prior to 2.13.4, resource exhaustion can occur because of a missing check in `BeanDeserializer._deserializeFromArray` to prevent the use of deeply nested arrays. An application is vulnerable only under certain customized deserialization settings.

More information here.

Test

The CheckDependencies build task should not contain any errors of the type “com.top-logic:tl-parent-all.pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.13.2.2.”