Dependency org.codehaus.jackson:jackson-mapper-asl:1.9.13 leads to critical vulnerability: CVE-2019-17267

[aholowko]

Description

In the helix/zookeeper-api is a dependency to org.codehaus.jackson:jackson-mapper-asl:1.9.13 that leads to critical vulnerability:

CVE-2019-17267

Analysis

The old Jackson API is used only in a few places and most of the changes are quite straightforward and require only changing an import statement to use classes from the new version of Jackson library.

Recommendation

• remove affected dependency
• adjust code using old API to use new classes