[ZOOKEEPER-4628] CVE-2022-42003 CVE-2022-42004 HIGH: upgrade jackson-databind-2.13.3.jar to 2.13.4.1

• Type: Task
• Status: Resolved
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 3.5.10, 3.8.0, 3.7.1
• Component/s: security
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: Ivo Dujmovic
• Created: 24/Oct/22 20:02
• Updated: 12/Jul/24 06:53
• Resolved: 30/Jun/23 11:42

Description

Two High issues 

https://nvd.nist.gov/vuln/detail/CVE-2022-42003

https://nvd.nist.gov/vuln/detail/CVE-2022-42004

affect jackson version 2.13.3 which zk should update to 2.13.4.1 

Other projects have done this, but Zookeeper has not.

Issue Links

• Blocked: ZOOKEEPER-4333 QuorumSSLTest - testOCSP fails on JDK17
• duplicates: ZOOKEEPER-4661 Upgrade Jackson Databind to 2.13.4.2 for CVE-2022-42003 CVE-2022-42004
• is related to: ZOOKEEPER-4627 High CVE-2022-2048 in jetty-*-9.4.46.v20220331.jar fixed in 9.4.47
• links to: GitHub Pull Request #1940