[SOLR-16443] Upgrade Jackson bom to 2.13.4.20221013

• Type: Task
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 8.11.2, 9.1
• Fix Version/s: main (10.0), 9.1.1
• Assignee: Kevin Risden
• Reporter: Nicolò Mendola
• Created: 06/Oct/22 14:12
• Updated: 25/Jan/23 16:16
• Resolved: 23/Oct/22 08:42

Description

Due to actual jackson-databind cve  listing CVE-2022-42004 and CVE-2022-42003 the Libary should be updated.

https://nvd.nist.gov/vuln/detail/CVE-2022-42004

https://nvd.nist.gov/vuln/detail/CVE-2022-42003
 

Perhaps for version 9.1.0 as well as 8.11.2?

Best Regards

Issue Links

• relates to: LOG4J2-3609 javac error when PluginProcessor (log4j-core jar) is in the classpath and annotation is not