[SOLR-13112] Upgrade jackson to 2.9.8

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 7.6
• Fix Version/s: 7.7.2, 8.1, 9.0

Environment

RedHat Linux.    May run from RHEL versions 5, 6 or 7 but this issue is from Sonatype component scan and should be independent of Linux platform version.

• Assignee: Kevin Risden
• Reporter: RobertHathaway
• Created: 03/Jan/19 22:09
• Updated: 08/Jun/19 14:59
• Resolved: 10/May/19 19:15

Description

We can't move to Solr 7 without fixing this issue flagged by Sonatype scan Of Solr - 7.6.0 Build,
Using Scanner 1.56.0-01

Threat Level 8       Against Solr v7.6.  com.fasterxml.jackson.core : jackson-databind : 2.9.6
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14718

Issue Links

• is duplicated by: SOLR-13385 Upgrade dependency jackson-databind in solr package contrib/prometheus-exporter/lib
• links to: GitHub Pull Request #621