[IMPALA-11394] Upgrade jackson-databind to version 2.12.6.1 or above

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 4.2.0
• Fix Version/s: Impala 4.2.0
• Component/s: Infrastructure
• Epic Color: ghx-label-1
• Assignee: Joe McDonnell
• Reporter: Joe McDonnell
• Created: 25/Jun/22 00:52
• Updated: 23/Aug/22 16:24
• Resolved: 23/Aug/22 16:24

Description

Jackson-databind has CVE-2020-36518 that is fixed in version 2.12.6.1 or above. We should upgrade our version listed here:

https://github.com/apache/impala/blob/master/java/pom.xml#L67

    <jackson-databind.version>2.10.5.1</jackson-databind.version>