[FLINK-27293] CVE-2020-36518 in flink-shaded jackson

• Type: Technical Debt
• Status: Closed
• Priority: Minor
• Resolution: Done
• Component/s: BuildSystem / Shaded
• Labels: auto-deprioritized-major pull-request-available
• Assignee: Unassigned
• Reporter: Spencer Deehring
• Created: 18/Apr/22 21:37
• Updated: 27/Sep/22 08:45
• Resolved: 27/Sep/22 08:45

Description

jackson-databind contains a CVE and is pulled in via jackson-bom located here: https://github.com/apache/flink-shaded/blob/master/flink-shaded-jackson-parent/pom.xml#L38

This needs to be updated to version 

2.12.6.20220326

as noted here: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12#micro-patches

Issue Links

• is superceded by: FLINK-29418 Update flink-shaded dependencies
• links to: GitHub Pull Request #109
• links to: GitHub Pull Request #110