[HADOOP-16905] Update jackson-databind to 2.10.3 to relieve us from the endless CVE patches

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.3.0, 3.2.3
• Labels: pull-request-available release-blocker
• Target Version/s: 3.3.0
• Hadoop Flags: Reviewed
• Assignee: Wei-Chiu Chuang
• Reporter: Wei-Chiu Chuang
• Created: 04/Mar/20 17:37
• Updated: 17/Dec/21 07:07
• Resolved: 07/Mar/20 03:21

Description

Jackson-databind 2.10 should relieve us from the endless CVE patches according to https://medium.com/@cowtowncoder/jackson-2-10-features-cd880674d8a2

Not sure if this is an easy update, but i think we should do this in the Hadoop 3.3.0 and before removing jackson-databind entirely.

Issue Links

• is related to: HADOOP-17049 javax.activation-api and jakarta.activation-api define overlapping classes
• is related to: HADOOP-17534 Upgrade Jackson databind to 2.10.5.1
• is related to: HIVE-24788 Backport HIVE-23338 to branch-3.1
• relates to: HADOOP-17249 Upgrade jackson-databind to 2.9.10.6 on branch-2.10
• links to: GitHub Pull Request #1876
• links to: GitHub Pull Request #1973
• links to: GitHub Pull Request #1976
• links to: GitHub Pull Request #3589
• links to: GitHub Pull Request #3590
• links to: GitHub Pull Request #3748