Update Jackson Databind to 2.13.4.2 (addressing CVE-2022-42003) (open…

…search-project#4779) Signed-off-by: Andriy Redko <andriy.redko@aiven.io> Signed-off-by: Andriy Redko <andriy.redko@aiven.io> (cherry picked from commit 12f26d3)
mch2 · Oct 13, 2022 · 26f527b · 26f527b
1 parent 482cb7b
commit 26f527b
Show file tree

Hide file tree

Showing 8 changed files with 173 additions and 7 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/buildSrc/version.properties b/buildSrc/version.properties
@@ -1,17 +1,16 @@
-opensearch        = 1.3.4
+opensearch        = 1.3.7
 lucene            = 8.10.1
 
 bundled_jdk_vendor = adoptium
-bundled_jdk = 11.0.15+10
-
+bundled_jdk = 11.0.16+8
 
 
 # optional dependencies
 spatial4j         = 0.7
 jts               = 1.15.0
-jackson           = 2.12.6
-jackson_databind  = 2.12.6.1
-snakeyaml         = 1.26
+jackson           = 2.13.4
+jackson_databind  = 2.13.4.2
+snakeyaml         = 1.32
 icu4j             = 62.1
 supercsv          = 2.4.0
 log4j             = 2.17.1
@@ -21,7 +20,7 @@ jdom2             = 2.0.6.1
 # when updating the JNA version, also update the version in buildSrc/build.gradle
 jna               = 5.5.0
 
-netty             = 4.1.73.Final
+netty             = 4.1.79.Final
 joda              = 2.10.12
 
 # when updating this version, you need to ensure compatibility with:

diff --git a/distribution/tools/upgrade-cli/licenses/jackson-databind-2.13.4.2.jar.sha1 b/distribution/tools/upgrade-cli/licenses/jackson-databind-2.13.4.2.jar.sha1
@@ -0,0 +1 @@
+325c06bdfeb628cfb80ebaaf1a26cc1eb558a585
diff --git a/modules/ingest-geoip/licenses/jackson-databind-2.13.4.2.jar.sha1 b/modules/ingest-geoip/licenses/jackson-databind-2.13.4.2.jar.sha1
@@ -0,0 +1 @@
+325c06bdfeb628cfb80ebaaf1a26cc1eb558a585
diff --git a/plugins/discovery-ec2/licenses/jackson-databind-2.13.4.2.jar.sha1 b/plugins/discovery-ec2/licenses/jackson-databind-2.13.4.2.jar.sha1
@@ -0,0 +1 @@
+325c06bdfeb628cfb80ebaaf1a26cc1eb558a585
diff --git a/plugins/repository-azure/licenses/jackson-databind-2.13.4.2.jar.sha1 b/plugins/repository-azure/licenses/jackson-databind-2.13.4.2.jar.sha1
@@ -0,0 +1 @@
+325c06bdfeb628cfb80ebaaf1a26cc1eb558a585
diff --git a/plugins/repository-hdfs/licenses/jackson-databind-2.13.4.2.jar.sha1 b/plugins/repository-hdfs/licenses/jackson-databind-2.13.4.2.jar.sha1
@@ -0,0 +1 @@
+325c06bdfeb628cfb80ebaaf1a26cc1eb558a585
diff --git a/plugins/repository-s3/licenses/jackson-databind-2.13.4.2.jar.sha1 b/plugins/repository-s3/licenses/jackson-databind-2.13.4.2.jar.sha1
@@ -0,0 +1 @@
+325c06bdfeb628cfb80ebaaf1a26cc1eb558a585