[TEZ-4485] Upgrade jettison to 1.5.4 due to CVE-2023-1436

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.10.3
• Assignee: Mayank Kunwar
• Reporter: Mayank Kunwar
• Created: 03/Apr/23 17:20
• Updated: 05/Apr/23 08:11
• Resolved: 05/Apr/23 08:11

Description

Upgrade jettison to 1.5.4 due to CVE-2023-1436

CVE-2023-1436:- An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

CVSSv3 Score:- 7.5(High)

Affected Version:- upto 1.5.4(excluding)

https://nvd.nist.gov/vuln/detail/CVE-2023-1436

 

Issue Links

• links to: GitHub Pull Request #279