From 95064e94b6f232ec283af6f7e025ea5fd94cbf6f Mon Sep 17 00:00:00 2001 From: Rundeck CI Date: Tue, 8 Sep 2026 15:18:18 -0700 Subject: [PATCH] Bump rundeck-core to 6.2.0-20260908 (CVE-2026-19032) rundeck-core 6.1.0-20260803 pulls in a vulnerable transitive Jackson version (CVE-2026-19032). 6.2.0-20260908 includes the fix. --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index ef7756d..584115b 100644 --- a/build.gradle +++ b/build.gradle @@ -63,8 +63,8 @@ configurations{ } dependencies { - compileOnly 'org.rundeck:rundeck-core:6.1.0-20260803' - testImplementation 'org.rundeck:rundeck-core:6.1.0-20260803' + compileOnly 'org.rundeck:rundeck-core:6.2.0-20260908' + testImplementation 'org.rundeck:rundeck-core:6.2.0-20260908' // Add secure commons-lang3 to provide alternative to vulnerable commons-lang 2.6 // Version 3.20.0 fixes CVE-2025-48924 (StackOverflowError in ClassUtils)