[CASSANDRA-14427] Bump jackson version to >= 2.9.5

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 4.0-alpha1, 4.0
• Assignee: Lerh Chuan Low
• Reporter: Lerh Chuan Low

Authors

Lerh Chuan Low

Reviewers

Jason Brown

• Created: 30/Apr/18 02:05
• Updated: 01/Nov/22 20:09
• Resolved: 18/May/18 05:29

Description

The Jackson being used by Cassandra is really old (1.9.2, and still references codehaus (Jackson 1) instead of fasterxml (Jackson 2)). 

There have been a few jackson vulnerabilities recently (mostly around deserialization which allows arbitrary code execution)

https://nvd.nist.gov/vuln/detail/CVE-2017-7525
https://nvd.nist.gov/vuln/detail/CVE-2017-15095
https://nvd.nist.gov/vuln/detail/CVE-2018-1327
https://nvd.nist.gov/vuln/detail/CVE-2018-7489

Given that Jackson in Cassandra is really old and seems to be used also for reading in values, it looks worthwhile to update Jackson to 2.9.5. 

Issue Links

• causes: CASSANDRA-18002 Update NetBeans project file for dependency changes since 7th July 2021