Need to update Jackson

[ddillard]

Issue Summary

Currently, sendgrid-java uses Jackson 2.5.3. Unfortunately, Jackson Databind 2.5.3 has a known remote code execution vulnerability. Also, given how far back the fix was made it appears that Jackson 2.5.x is no longer supported as no fix was made for 2.5.

Steps to Reproduce

1. Read Jackson Deserializer security vulnerability via default typing (CVE-2017-7525) FasterXML/jackson-databind#1599

Any other information you want to share that is relevant to the issue being reported. Especially, why do you consider this to be a bug? What do you expect to happen instead?

Well, remote code execution vulnerabilities are bad. One led to the Equifax breach.

Technical details:

• sendgrid-java Version: master (latest commit:b98bbd80a234314e59e6601a5a619ed1b8d2b0e1)
• Java Version: doesn't matter

[thinkingserious]

Hello @ddillard,

Do you mind adding your vote to this issue? It is scheduled to be merged in our backlog and your vote helps give it priority.

Thanks!

With Best Regards,

Elmer