[KAFKA-14044] Upgrade Netty and Jackson for CVE fixes

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.2.0
• Fix Version/s: 3.3.0
• Component/s: core
• Labels: security
• Assignee: Thomas Cooper
• Reporter: Thomas Cooper
• Created: 04/Jul/22 16:26
• Updated: 18/Oct/22 22:51
• Resolved: 05/Jul/22 07:28

Description

There are a couple of CVEs for netty and Jackson:

Netty: CVE-2022-24823 - Fixed by upgrading to 4.1.77+

Jackson: CVE-2020-36518 - Fixed by upgrading to 2.13.0+

Issue Links

• is cloned by: KAFKA-14320 Upgrade Jackson for CVE fix
• is duplicated by: KAFKA-13969 CVE-2022-24823 in netty 4.1.76.Final
• links to: GitHub Pull Request #12376