Update Jackson, SnakeYAML, Spring, and JAVA versions

[VictorCavichioli]

Story Description:
Evaluate how to upgrade the versions of Jackson and SnakeYAML, after change #701 I saw that we have some other things to update together, else the openapi fails.

Also step to Spring 6 and JAVA 17

Acceptance Criteria:

NA

Definition of Done:

Change approved by maintainers and passing on tests

Notes:

NA

[dapc11]

Hi,

A lot of CVEs to be fixed by uplifting Spring to 6.1.x:

• CVE-2024-38819
• CVE-2024-38820
• CVE-2016-1000027
• CVE-2024-38816
• CVE-2024-38809
• CVE-2024-38808

SnakeYaml stepping to 2.x would solve:

• CVE-2022-25857
• CVE-2022-38749
• CVE-2022-38750
• CVE-2022-38751
• CVE-2022-38752
• CVE-2022-41854
• CVE-2022-1471

//DT

[VictorCavichioli]

Guava:

• Guava vulnerable to insecure use of temporary directory
• Information Disclosure in Guava

Fix available in 32.0.0-android, we are using version 32.0.1-jre, but the com.datastax.oss/java-driver-shaded-guava uses version 25.1-jre. This dependency was moved to com.datastax.oss/java-driver-core so I think we don't actually need the shaded-guava, so we can remove this i guess (Not fully sure), and add an exclusion on the java-driver-core so we can use 32.0.1-jre as guava version.

Spring:

• Spring Framework DataBinder Case Sensitive Match Exception - org.springframework:spring-context - Fix in >= 6.1.14/6.0.25
• Spring Framework vulnerable to Denial of Service - org.springframework:spring-expression - Fix in >= 5.3.39
• Pivotal Spring Framework contains unsafe Java deserialization methods - org.springframework:spring-web - Fix in >= 6.0.0
• Spring Framework DoS via conditional HTTP request - org.springframework:spring-web - Fix in >= 6.0.23/6.1.12
• Path traversal vulnerability in functional web frameworks - org.springframework:spring-webmvc - Fix in >= 6.1.13/6.0.24

Apache Tomcat - Denial of Service:

• org.apache.tomcat.embed:tomcat-embed-core - Fix in >= 11.0.0-M21/10.1.25/9.0.90
• org.apache.tomcat:tomcat-coyote - Fix in >= 11.0.0-M21/10.1.25/9.0.90

[jwaeab]

Guava:

• Guava vulnerable to insecure use of temporary directory
• Information Disclosure in Guava

Fix available in 32.0.0-android, we are using version 32.0.1-jre, but the com.datastax.oss/java-driver-shaded-guava uses version 25.1-jre. This dependency was moved to com.datastax.oss/java-driver-core so I think we don't actually need the shaded-guava, so we can remove this i guess (Not fully sure), and add an exclusion on the java-driver-core so we can use 32.0.1-jre as guava version.

Spring:

• Spring Framework DataBinder Case Sensitive Match Exception - org.springframework:spring-context - Fix in >= 6.1.14/6.0.25
• Spring Framework vulnerable to Denial of Service - org.springframework:spring-expression - Fix in >= 5.3.39
• Pivotal Spring Framework contains unsafe Java deserialization methods - org.springframework:spring-web - Fix in >= 6.0.0
• Spring Framework DoS via conditional HTTP request - org.springframework:spring-web - Fix in >= 6.0.23/6.1.12
• Path traversal vulnerability in functional web frameworks - org.springframework:spring-webmvc - Fix in >= 6.1.13/6.0.24

Apache Tomcat - Denial of Service:

• org.apache.tomcat.embed:tomcat-embed-core - Fix in >= 11.0.0-M21/10.1.25/9.0.90
• org.apache.tomcat:tomcat-coyote - Fix in >= 11.0.0-M21/10.1.25/9.0.90

The current status on my work (so it aligns with above issues):

guava = 33.3.1-jre
spring = 6.1.14
tomcat = 10.1.31
... but many, many other versions (with their vulnerabilities) are also needed to be stepped.

Regarding the shading, it has been removed due to the fact (as you state) it has been moved to java-driver-core.