Status
Impact
The jackson-core vulnerability cannot be upgraded to the fix version (2.15.0+) due to Java 8 compatibility requirements. Tez 0.10.5 requires Java 8 (openjdk-8-default-jvm) while jackson-core 2.15.0+ requires Java 11+. This requires either an upstream Tez release that supports Java 11+ or a jackson-core backport that maintains Java 8 compatibility with the security fix.
Status