[FLINK-29638] Update jackson bom because of CVE-2022-42003

• Type: Technical Debt
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.16.0, 1.17.0, 1.15.2
• Fix Version/s: 1.16.0, 1.17.0, 1.15.3
• Labels: pull-request-available
• Assignee: Sergey Nuyanzin
• Reporter: Sergey Nuyanzin
• Created: 14/Oct/22 08:17
• Updated: 20/Oct/22 05:22
• Resolved: 19/Oct/22 19:29

Description

There is a CVE-2022-42003 fixed in 2.13.4.1 and 2.14.0-rc1
https://nvd.nist.gov/vuln/detail/CVE-2022-42003

P.S. It seems there will not be 2.14.0 release until end of October according to https://github.com/FasterXML/jackson-databind/issues/3590#issuecomment-1270363915

Issue Links

• is related to: FLINK-29468 Update jackson-bom to 2.13.4
• links to: GitHub Pull Request #21064
• links to: GitHub Pull Request #21106
• links to: GitHub Pull Request #21107