CVE-2020-36518 Patch

[mj-easy]

I was going to submit a patch for CVE-2020-36518 but it appears someone patched it already in #11351. Is there an ETA for Play 2.18.17 at the moment?

Regards.

[mkurz]

Play 2.8.x still uses Jackson 2.11.4:

playframework/project/Dependencies.scala

Lines 39 to 40 in 48c7456

	val jacksonVersion = "2.11.4"
	val jacksonDatabindVersion = jacksonVersion

The pull request you refer is for the main branch.

[mj-easy]

Oh! I see.