[FLINK-21020] Bump Jackson to 2.10.5[.1] / 2.12.1

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: shaded-9.0, shaded-10.0, shaded-11.0, shaded-12.0
• Fix Version/s: shaded-13.0, 1.11.4, 1.12.2, 1.13.0
• Component/s: BuildSystem / Shaded
• Labels: pull-request-available
• Assignee: Huang Xingbo
• Reporter: Dian Fu
• Created: 19/Jan/21 04:59
• Updated: 28/May/21 08:07
• Resolved: 26/Jan/21 15:44

Description

Our current Jackson version (2.10.1) is vulnerable for at least this CVE:
https://nvd.nist.gov/vuln/detail/CVE-2020-25649

Bump it to 2.10.5.1+ should address this issue.

Issue Links

• is duplicated by: FLINK-21544 Upgrade Jackson databind version from 2.10.1 used in, at least, Flink Python jar
• relates to: FLINK-21152 Bump flink-shaded to 13.0
• links to: GitHub Pull Request #93
• links to: GitHub Pull Request #14717
• links to: GitHub Pull Request #14745
• links to: GitHub Pull Request #14746