Embedded repackaged Jackson Version has known vulnerabilities

[barrycaceres]

Describe the bug

Jackson libraries are repackaged under a "thirdparty" package and embedded, however the versions used have known security vulnerabilities triggering code scan failures.

See: https://github.com/aws/aws-sdk-java-v2/blob/master/pom.xml#L94

    <jackson.version>2.13.2</jackson.version>
    <jackson.databind.version>2.13.4.2</jackson.databind.version>
    <jacksonjr.version>2.13.2</jacksonjr.version>

Version 2.13.2 has the following known vulnerabilities:

https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.13.2

Latest version 2.14.2 does not have these vulnerabilities.

Expected Behavior

Expect AWS JAR to pass security code scans by not embedding third-party software with known security vulnerabilities.

Current Behavior

Code scan for one of our customers failed because it detected Jackson version 2.13.2

Reproduction Steps

N/A

Possible Solution

Replace Jackson versions with version 2.14.2.

Additional Information/Context

Reported as a security vulnerability over two weeks ago and despite new releases since then, this has not been addressed.

AWS Java SDK version used

2.20.20

JDK version used

openjdk version "11.0.17" 2022-10-18

Operating System and version

macOS 13.2.1

[debora-ito]

@barrycaceres the SDK is using jackson-databind 2.13.4.2. If you referring to the following CVEs:

CVE-2022-42004
CVE-2022-42003
CVE-2020-36518

version 2.13.4.2 is not affected. Maven central does not recognize when fixes are backported, but we followed the fixes in their original Github threads - See the "patched versions" section in the Github Security database:
CVE-2022-42004, CVE-2022-42003, CVE-2020-36518

If the security tool you use are reporting these vulnerabilities, maybe their database needs to be updated.

[barrycaceres]

Okay thanks -- I will share with our customer to have them update their security scan tool.