[SLING-12268] Fix CVE-2022-47937

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Commons JSON 2.0.24
• Component/s: Commons
• Assignee: Remo Liechti
• Reporter: Remo Liechti
• Created: 19/Mar/24 12:46
• Updated: 20/Mar/24 12:10
• Resolved: 19/Mar/24 12:56

Description

Current version of apache commons json is affected by https://nvd.nist.gov/vuln/detail/CVE-2022-47937

Due to the relicenced base library (https://github.com/stleary/JSON-java), that now uses the 'public domain', the fix of that CVE is as simple as migrating to the latest codebase of said library.

Along this, it would be beneficial to perform some side activities, such as the upgrade to the latest parent pom and junit5.

Issue Links

• relates to: LEGAL-666 Use of org.json with public domain license
• links to: GitHub Pull Request #2