# Logstash-8.3.3 (latest) still using jackson-databind-2.9.10.8

**URL:** <https://discuss.elastic.co/t/logstash-8-3-3-latest-still-using-jackson-databind-2-9-10-8/311694>\
**Category:** Logstash\
**Created:** [August 9, 2022, 8:12am UTC](https://discuss.elastic.co/t/logstash-8-3-3-latest-still-using-jackson-databind-2-9-10-8/311694 "2022-08-09T08:12:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivani\_aggarwal](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\
**Post date:** [August 9, 2022, 8:12am UTC](https://discuss.elastic.co/t/logstash-8-3-3-latest-still-using-jackson-databind-2-9-10-8/311694/1 "2022-08-09T08:12:06Z")

</div>

As per [logstash 8.3.0 release notes](https://www.elastic.co/guide/en/logstash/current/logstash-8-3-0.html#dependencies-8.3.0) ,

- Jackson and jackson-databind have been updated to 2.13.3 [#13945](https://github.com/elastic/logstash/pull/13945)

But we see the logstash rpm also brings a plugin logstash-input-beats - **that still uses jackson-databind-2.9.10.8.**  
This is seen with latest logstash 8.3.3 release too.

```auto
$ rpm -q -l -p logstash-oss-8.3.3-x86_64.rpm | grep jackson | grep ".jar" | grep -v "2.13.3"
warning: logstash-oss-8.3.3-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jrjackson-0.4.16-java/lib/jrjackson/jars/jrjackson-1.2.33.jar
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jrjackson-0.4.16-java/lib/jrjackson_jars.rb
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.4.0-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-annotations/2.9.10/jackson-annotations-2.9.10.jar
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.4.0-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-core/2.9.10/jackson-core-2.9.10.jar
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.4.0-java/vendor/jar-dependencies/com/fasterxml/jackson/core/jackson-databind/2.9.10.8/jackson-databind-2.9.10.8.jar
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.4.0-java/vendor/jar-dependencies/com/fasterxml/jackson/module/jackson-module-afterburner/2.9.10/jackson-module-afterburner-2.9.10.jar

```

The jackson-databind-2.9.10.8 has associated security vulnerabilties and is already reached End of Life.  
Pls let us know when will this be fixed and the dependent plugins using \>=2.13.3 will be consumed.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2022, 8:12am UTC](https://discuss.elastic.co/t/logstash-8-3-3-latest-still-using-jackson-databind-2-9-10-8/311694/2 "2022-09-06T08:12:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.