From 394dfa1ce7317258c0576e2e6061c6d4221d5c14 Mon Sep 17 00:00:00 2001
From: Shen-Ta Hsieh <ibmibmibm.tw@gmail.com>
Date: Sat, 31 Aug 2019 15:40:59 +0800
Subject: [PATCH] upgrade jackson-databind and commons-beanutils for CVEs

Signed-off-by: Shen-Ta Hsieh <ibmibmibm.tw@gmail.com>
---
 airsonic-main/pom.xml | 1 +
 pom.xml               | 7 +++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/airsonic-main/pom.xml b/airsonic-main/pom.xml
index 3aad5905..adcf126f 100755
--- a/airsonic-main/pom.xml
+++ b/airsonic-main/pom.xml
@@ -426,6 +426,7 @@
         <dependency>
             <groupId>commons-beanutils</groupId>
             <artifactId>commons-beanutils</artifactId>
+            <version>1.9.4</version>
             <!-- commons-configuration2 requires during runtime -->
             <scope>runtime</scope>
         </dependency>
diff --git a/pom.xml b/pom.xml
index 28bb7700..d35bb64a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -17,7 +17,6 @@
         <failOnDependencyWarning>true</failOnDependencyWarning>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <cxf.version>3.3.1</cxf.version>
-        <jackson.version>2.9.9</jackson.version>
         <tomcat.version>8.5.42</tomcat.version>
     </properties>
 
@@ -114,17 +113,17 @@
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-core</artifactId>
-                <version>${jackson.version}</version>
+                <version>2.9.9</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>${jackson.version}</version>
+                <version>2.9.9.3</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-annotations</artifactId>
-                <version>${jackson.version}</version>
+                <version>2.9.9</version>
             </dependency>
             <dependency>
                 <groupId>com.google.guava</groupId>