From d9d63223fa96cec0ffc0d08b1c7a0e009b30bd7d Mon Sep 17 00:00:00 2001
From: silpidhua <silpidhua@gmail.com>
Date: Thu, 2 Jun 2022 21:08:42 +0530
Subject: [PATCH] Upgrade version of jackson_databind and commons_codec as per
 twistlock (#308)

scan report

Co-authored-by: Silpi Dhua <Silpi.Dhua1@ibm.com>
---
 pom.xml | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 2056f89b..9897fefd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -65,11 +65,11 @@
         <hadoop.version>3.2.3</hadoop.version>
         <junit.version>4.13.1</junit.version>
         <jackson.version>1.9.13</jackson.version>
-        <httpcomponents.httpcore.version>4.4.11</httpcomponents.httpcore.version>
+        <httpcomponents.httpcore.version>4.4.14</httpcomponents.httpcore.version>
         <httpcomponents.client5.version>5.0.3</httpcomponents.client5.version>
         <powermock.version>2.0.2</powermock.version>
         <mockito.version>2.28.2</mockito.version>
-        <amazon.sdk.version>1.11.596</amazon.sdk.version>
+        <amazon.sdk.version>1.11.1034</amazon.sdk.version>
         <google.guava.version>30.0-jre</google.guava.version>
     </properties>
 
@@ -91,6 +91,14 @@
             <version>${hadoop.version}</version>
             <scope>provided</scope>
             <exclusions>
+               <exclusion>
+                  <groupId>commons-codec</groupId>
+                  <artifactId>commons-codec</artifactId>
+               </exclusion>
+               <exclusion>
+                  <groupId>com.fasterxml.jackson.core</groupId>
+                  <artifactId>jackson-databind</artifactId>
+               </exclusion>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>*</artifactId>
@@ -142,6 +150,10 @@
                    <groupId>javax.servlet</groupId>
                    <artifactId>*</artifactId>
                </exclusion>
+               <exclusion>
+                  <groupId>com.fasterxml.jackson.core</groupId>
+                  <artifactId>jackson-databind</artifactId>
+               </exclusion>
             </exclusions>
         </dependency>
         <dependency>
@@ -151,6 +163,14 @@
             <type>test-jar</type>
             <version>${hadoop.version}</version>
             <exclusions>
+               <exclusion>
+                  <groupId>commons-codec</groupId>
+                  <artifactId>commons-codec</artifactId>
+               </exclusion>
+               <exclusion>
+                  <groupId>com.fasterxml.jackson.core</groupId>
+                  <artifactId>jackson-databind</artifactId>
+               </exclusion>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>*</artifactId>
@@ -208,6 +228,17 @@
             <artifactId>httpcore</artifactId>
             <version>${httpcomponents.httpcore.version}</version>
         </dependency>
+        <!-- override transitive dependency versions for security fixes -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-cbor</artifactId>
+            <version>2.13.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+            <version>4.5.13</version>
+        </dependency>
         <!-- Test dependencies -->
         <dependency>
             <groupId>junit</groupId>