[PARQUET-2198] Vulnerabilities in jackson-databind

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.12.3
• Fix Version/s: 1.13.0
• Labels: jackson-databind security vulnerabilities
• Assignee: Unassigned
• Reporter: Łukasz Dziedziul
• Created: 06/Oct/22 09:36
• Updated: 23/Jun/24 03:32
• Resolved: 26/Mar/23 06:01

Description

Update jackson-databind to mitigate CVEs:

• CVE-2022-42003 - https://nvd.nist.gov/vuln/detail/CVE-2022-42003
• CVE-2022-42004 - https://nvd.nist.gov/vuln/detail/CVE-2022-42004 (fixed in  2.13.4)