[PARQUET-1842] Update Jackson Databind version to address CVE

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.11.0
• Fix Version/s: 1.12.0
• Component/s: parquet-mr
• Labels: pull-request-available

Environment

Any

• Assignee: Unassigned
• Reporter: Patrick OFriel
• Created: 16/Apr/20 17:06
• Updated: 03/Jun/20 12:32
• Resolved: 22/Apr/20 18:48

Description

The current version of jackson-databind in parquet-mr has several CVEs associated with it: https://nvd.nist.gov/vuln/detail/CVE-2020-10673, https://nvd.nist.gov/vuln/detail/CVE-2020-10672, https://nvd.nist.gov/vuln/detail/CVE-2020-10969, https://nvd.nist.gov/vuln/detail/CVE-2020-11111, https://nvd.nist.gov/vuln/detail/CVE-2020-11113, (and a few more). We should update to jackson-databind 2.9.10.4

Issue Links

• links to: GitHub Pull Request #785