Dependency upgrade

[ckunki]

See log messages from build job Dependency Check:

• org.alluxio:alluxio-core-common:jar:300 in compile
  • CVE-2020-21485, severity CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (6.1)
• org.xerial.snappy:snappy-java:jar:1.1.8.2 in compile
  • CVE-2023-34453, severity CWE-190: Integer Overflow or Wraparound (7.5)
  • CVE-2023-34454, severity CWE-190: Integer Overflow or Wraparound (7.5)
  • CVE-2023-34455, severity CWE-770: Allocation of Resources Without Limits or Throttling (7.5)
• io.netty:netty-handler:jar:4.1.93.Final in compile
  • CVE-2023-34462, severity CWE-770: Allocation of Resources Without Limits or Throttling (6.5)

Excluded vulnerabilities:

• [CVE-2023-33546] CWE-787: Out-of-bounds Write (5.5); https://ossindex.sonatype.org/vulnerability/CVE-2023-33546?component-type=maven&component-name=org.codehaus.janino%2Fjanino&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• [CVE-2019-10172] CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (7.5); https://ossindex.sonatype.org/vulnerability/CVE-2019-10172?component-type=maven&component-name=org.codehaus.jackson%2Fjackson-mapper-asl&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• [CVE-2020-36641] CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (9.8); https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• [CVE-2023-22946] CWE-269: Improper Privilege Management (9.9); https://ossindex.sonatype.org/vulnerability/CVE-2023-22946?component-type=maven&component-name=org.apache.spark%2Fspark-core_2.13&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• [CVE-2017-7525] CWE-184: Incomplete Blacklist (9.8); https://ossindex.sonatype.org/vulnerability/CVE-2017-7525?component-type=maven&component-name=org.codehaus.jackson%2Fjackson-mapper-asl&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1

[morazow]

Thanks for the detailed feedback @ckunki !

I am going to address them.

[morazow]

Remarks: the release process seem to be failing, we should also check that release is successful after the changes.