Upgrade Jackson's dependencies to address PRISMA-2023-0067

[Mariamalmesfer]

Description

This PR upgrades Jackson dependencies to version 2.15.4, addressing the security vulnerabilities identified in PRISMA-2023-0067.

Motivation and Context

Reasons for upgradation:
The upgrade to Jackson 2.15.4 resolves multiple critical security vulnerabilities, including a Denial of Service (DoS) vulnerability in jackson-core, caused by improper input validation during numeric type conversions. This update ensures enhanced security and system stability.

Impact

Image Scan showed the vulnerability have been removed.
Image scan report :
Image-scan-report-9 Sep.csv

Test Plan

Contributor checklist

• Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

 == RELEASE NOTES == =

Security Changes
* Upgrade Jackson dependencies to 2.15.4 in response to `PRISMA-2023-0067 <https://www.ibm.com/support/pages/security-bulletin-vulnerability-jackson-core-might-affect-ibm-business-automation-workflow-prisma-2023-0067>`_. :pr:`23753`

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Mariamalmesfer / name: Mariam AlMesfer (fd9be63)

[elharo]

Why not a later version like 2.17.1?

[elharo]

I know @steveburnett disagrees with me about this, but I really don't think we should be including dependency upgrades in the release notes.

[elharo]

Looks like the most recent version is 2.18.0

[Mariamalmesfer]

Looks like the most recent version is 2.18.0

The CVS scan suggests upgrading to version 2.15.0, as that's where the vulnerability was fixed. But if we want the latest updates, we can go with 2.18.0. Let me know your preference

[elharo]

I'd prefer to go to the latest (honestly I'd prefer not to depend on jackson at all) but this is still an improvement.

[agrawalreetika]

@Mariamalmesfer @elharo Maybe we can update to the one version before the very latest which is 2.17.2 what do you think?

[Mariamalmesfer]

@Mariamalmesfer @elharo Maybe we can update to the one version before the very latest which is 2.17.2 what do you think?

Sounds good to me. We can go with 2.17.2 if that works for everyone.
cc: @elharo

[steveburnett]

Please update the release note entry to the version being updated to. For example

 == RELEASE NOTES == =

Security Changes
* Upgrade Jackson-core to 2.17.2 :pr:`#23753`

[elharo]

I prefer 2.18.0 but I'm not sure others agree with this. Don't overthink it. Either 2.17.2 or 2.18 is better than what we have now.

[agrawalreetika]

LGTM
I think the entry in release note should be changed since you are not just upgrading jackson-core here
cc @steveburnett

[steveburnett]

LGTM I think the entry in release note should be changed since you are not just upgrading jackson-core here cc @steveburnett

I agree @agrawalreetika, thank you!

@Mariamalmesfer , please update the release note entry to describe the other changes you are making. Also, please include at least one of the CVEs addressed by this PR. For formatting of the link to the CVE, see the example in Phrasing in the Release Note Guidelines. Thanks!

[steveburnett]

two nits in the release note entry, looks good otherwise. Suggested edits below:

== RELEASE NOTES == =

Security Changes

• Upgrade Jackson dependencies to 2.15.4 in response to PRISMA-2023-0067 <https://www.ibm.com/support/pages/security-bulletin-vulnerability-jackson-core-might-affect-ibm-business-automation-workflow-prisma-2023-0067>_. :pr:23753

[tdcmeehan]

Just one last nit, otherwise looks good.

[steveburnett]

Thanks for the release note entry update! Some minor nits of formatting in the release note entry - my bad, I should have put ``` before and after the draft in my previous comment to display the single `s in the draft.

 == RELEASE NOTES == =

Security Changes
* Upgrade Jackson dependencies to 2.15.4 in response to `PRISMA-2023-0067 <https://www.ibm.com/support/pages/security-bulletin-vulnerability-jackson-core-might-affect-ibm-business-automation-workflow-prisma-2023-0067>`_. :pr:`23753`

[Mariamalmesfer]

Thanks for the release note entry update! Some minor nits of formatting in the release note entry - my bad, I should have put ``` before and after the draft in my previous comment to display the single `s in the draft.

 == RELEASE NOTES == =

Security Changes
* Upgrade Jackson dependencies to 2.15.4 in response to `PRISMA-2023-0067 <https://www.ibm.com/support/pages/security-bulletin-vulnerability-jackson-core-might-affect-ibm-business-automation-workflow-prisma-2023-0067>`_. :pr:`23753`

Thank you @steveburnett!

Stale