[SOLR-16572] Update FasterXML Woodstox Dependency for CVE-2022-40153

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 9.0, 8.11.2, main (10.0)
• Assignee: Unassigned
• Reporter: Kira Traynor
• Created: 02/Dec/22 19:13
• Updated: 25/Jan/23 16:15
• Resolved: 02/Dec/22 19:22

Description

There are CVEs associated with the com.fasterxml.woodstox:woodstox-core dependency. The current version of this dependency in Solr is 6.2.8 and the vulnerabilities are fixed in 6.4.0. 

All the CVEs related to woodstox-core version 6.2.8:

CVE-2022-40156
CVE-2022-40155
CVE-2022-40154
CVE-2022-40153

Issue Links

• duplicates: SOLR-16568 Update woodstox-core to 6.4.0 to mitigate CVE-2022-40152