# Logstash how to solve the problem about jackson-databind CVE-2019-12384

**URL:** <https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2019-12384/194134>\
**Category:** Logstash\
**Created:** [August 7, 2019, 3:54am UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2019-12384/194134 "2019-08-07T03:54:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![muyuqj](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@muyuqj](https://discuss.elastic.co/u/muyuqj)\
**Post date:** [August 7, 2019, 3:54am UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2019-12384/194134/1 "2019-08-07T03:54:53Z")

</div>

> <https://github.com/FasterXML/jackson-databind/issues/2334>

logstash how to solve the problem about jackson-databind CVE-2019-12384

my path is:  
/usr/local/logstash/logstash-core/lib/jars/jackson-annotations-2.9.5.jar  
it is seem the jackson lib version is 2.9.5,  
This bug must update the jackson lib to 2.9.9.1  
But the lastest logstash's version of jackson lib is 2.9.8,So i don't know how to solve this problem , Anyone can help me ?

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [August 7, 2019, 10:26am UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2019-12384/194134/2 "2019-08-07T10:26:01Z")

</div>

Logstash is not vulnerable to this CVE.

We only use Jackson to deserialise JSON strings into a fixed (controlled by us) set of internal or standard Ruby/Java classes and then to serialise these same fixed set of classes into standard JSON.

We will update Jackson and JrJackson in due course.

---

<div class="post-metadata">

**Author:** ![muyuqj](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@muyuqj](https://discuss.elastic.co/u/muyuqj)\
**Post date:** [August 7, 2019, 10:33am UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2019-12384/194134/3 "2019-08-07T10:33:54Z")

</div>

Thanks .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 10:34am UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2019-12384/194134/4 "2019-09-04T10:34:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.