Recently, when running the OWASP Dependency-Check tool on my project, both android-json-0.0.20131108.vaadin1.jar and jackson-core-2.16.0.jar were flagged with CVE-2023-5072. However, I couldn’t find much recent information about this CVE other than a GitHub issue related to JSON-Java (https://github.com/jeremylong/DependencyCheck/issues/5991).
For android-json-0.0.20131108.vaadin1.jar, the dependency information is as follows:
cpe:2.3:a:json-java_project:json-java:0.0:20131108:*:*:*:*:*:*
pkg:maven/com.vaadin.external.google/[email protected]
For jackson-core-2.16.0.jar, the dependency information is as follows:
cpe:2.3:a:fasterxml:jackson-modules-java8:2.16.0:*:*:*:*:*:*:*
cpe:2.3:a:json-java_project:json-java:2.16.0:*:*:*:*:*:*:*
pkg:maven/com.fasterxml.jackson.core/[email protected]
Does anybody have more information about whether these dependencies are affected by CVE-2023-5072? Any updates or insights would be greatly appreciated.
Thank you.