# Vulnerability CVE-2020-25649 reported on Elasticsearch 7.17.4
**URL:** https://discuss.elastic.co/t/vulnerability-cve-2020-25649-reported-on-elasticsearch-7-17-4/306855
**Category:** Elasticsearch
**Created:** [June 10, 2022, 8:19am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-25649-reported-on-elasticsearch-7-17-4/306855 "2022-06-10T08:19:20Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sbrunot](https://discuss.elastic.co/u/sbrunot)
#### Post date: [June 10, 2022, 8:19am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-25649-reported-on-elasticsearch-7-17-4/306855/1 "2022-06-10T08:19:20Z")
Hello,
vulnerability CVE-2020-25649 is reported on the jackson-databind-2.10.4.jar library of the ingest-geoip module of Elasticsearch (modules/ingest-geoip/jackson-databind-2.10.4.jar).
Are there any official statements regarding if this vulnerability does indeed apply to Elasticsearch 7.17.4, or any plan to upgrade jackson-databind to a version that does not have the vulnerability ?
If not, is there any way that I can help upgrading this dependency to a higher version ?
Thanks for your help on this.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 10, 2022, 2:15pm UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-25649-reported-on-elasticsearch-7-17-4/306855/2 "2022-06-10T14:15:42Z")
Thank you for your report.
Elastic's security reporting guidelines are available at [Security issues | Elastic](https://www.elastic.co/community/security).
Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to [security@elastic.co](mailto:security@elastic.co).
We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.
---
### Author:  [@sbrunot](https://discuss.elastic.co/u/sbrunot)
#### Post date: [June 13, 2022, 7:36am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-25649-reported-on-elasticsearch-7-17-4/306855/3 "2022-06-13T07:36:39Z")
email sent, thank you @ikakavas.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 11, 2022, 7:36am UTC](https://discuss.elastic.co/t/vulnerability-cve-2020-25649-reported-on-elasticsearch-7-17-4/306855/4 "2022-07-11T07:36:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.