CVE-2022-25647 vulnerable gson v2.8.5 in dependency-check-core

[albuch]

gson library included in dependency-check-core@7.0.4 is vulnerable to CVE-2022-25647, see https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327 and google/gson#1991

• Intoduced through: org.owasp:dependency-check-core@7.0.4 › com.moandjiezana.toml:toml4j@0.7.2 › com.google.code.gson:gson@2.8.5
• Introduced through: org.owasp:dependency-check-core@7.0.4 › org.sonatype.ossindex:ossindex-service-client@1.8.1 › com.google.code.gson:gson@2.8.5

Patched in gson v2.8.9+

Unfortunately toml4j seems to be not maintained anymore. I've already filed an upstream issue for ossindex-service-client at sonatype/ossindex-public#31

[aikebah]

As there are already other jackson dependencies I think jackson-dataformats-text (listed on the toml wiki as a 1.0.0 compliant implementation) might be a candidate for replacing toml4j.

[jeremylong]

gson has been upgraded with #4710.