From 25bf7bd4e51e8260e3274251bbd4c8fd1c9af7ae Mon Sep 17 00:00:00 2001
From: Felix Dittrich <Felix.Dittrich@t-systems.com>
Date: Mon, 19 Jun 2023 12:07:03 +0200
Subject: [PATCH] Update Jackson

---
 owasp/suppressions.xml |  8 ++++++++
 pom.xml                | 23 +++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/owasp/suppressions.xml b/owasp/suppressions.xml
index 3fd8b02..5ff56ad 100644
--- a/owasp/suppressions.xml
+++ b/owasp/suppressions.xml
@@ -4,4 +4,12 @@
     <notes>no YAML content from users is parsed within this service</notes>
     <cve>CVE-2022-1471</cve>
   </suppress>
+  <suppress>
+    <notes>False positive</notes>
+    <cve>CVE-2022-45688</cve>
+  </suppress>
+  <suppress>
+    <notes>No fix available, still analyzed</notes>
+    <cve>CVE-2023-35116</cve>
+  </suppress>
 </suppressions>
diff --git a/pom.xml b/pom.xml
index e60a8b3..77878df 100644
--- a/pom.xml
+++ b/pom.xml
@@ -87,6 +87,17 @@
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-openfeign</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-fileupload</groupId>
+                    <artifactId>commons-fileupload</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
+            <version>1.5</version>
         </dependency>
         <dependency>
             <groupId>io.github.openfeign</groupId>
@@ -120,10 +131,22 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
+            <version>2.15.2</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>2.15.2</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
+            <version>2.15.2</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+            <version>2.15.2</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>