[Snyk:High] net.minidev:json-smart Denial of Service (DoS)(due by 05/31/2023)

[pkfec]

Overview
net.minidev:json-smart is a Java JSON parser. Affected versions of this package are vulnerable to Denial of Service (DoS) due to a StackOverflowError when parsing a deeply nested JSON array or object.

NOTE: Although this vulnerability was fixed in version 2.4.9 the maintainer recommends upgrading to 2.4.10, due to a remaining bug.

Introduced through: org.flywaydb:flyway-commandline@9.16.3
Fixed in: net.minidev:json-smart@2.4.9

Detailed paths
Introduced through: unknown:unknown@0.0.0 › org.flywaydb:flyway-commandline@9.16.3 › com.microsoft.azure:msal4j@1.13.7 › net.minidev:json-smart@2.4.8
Fix: Your dependencies are out of date, otherwise you would be using a newer net.minidev:json-smart than net.minidev:json-smart@2.4.8. Try reinstalling your dependencies. If the problem persists, one of your dependencies may be bundling outdated modules.
Introduced through: unknown:unknown@0.0.0 › org.flywaydb:flyway-commandline@9.16.3 › com.microsoft.azure:msal4j@1.13.7 › com.nimbusds:oauth2-oidc-sdk@9.35 › net.minidev:json-smart@2.4.8

https://app.snyk.io/org/fecgov/project/e6c155e9-f0ac-4a49-98fa-83c24f5b74b3#issue-SNYK-JAVA-NETMINIDEV-3369748

Action items:

• Upgrade flyway to the latest version

Completion criteria

• Snyk no longer flagging this error

[pkfec]

@tmpayton Flyway 9.17.0 is now available

[tmpayton]

@pkfec Thank you!