• A security scan has picked up the following vulnerabilities related to jettison-1.x.x jar: CVE-2022-40150 & CVE-2022-40149. This jar is found in marketplace\Liferay Foundation - Liferay Portal Remote - Impl.lpkg\com.liferay.portal.remote.rest.extender-6.0.12.jar\lib directory.
• Versions of Jettison below Version 1.5.1 could be vulnerable.

CVE-2022-40149: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

CVE-2022-40150: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

• Liferay DXP 7.2, 7.3, 7.4, (7.4 Update 48 Resolved)

• Liferay is vulnerable to this CVE unless Jettison is upgraded to 1.5.1 or later. This can be done by requesting a hotfix containing the fix "LPE-17635". 
  
  
• To verify that Jettison has been updated successfully, you can view the component's version at the physical address below: 

  osgi\marketplace\Liferay Foundation - Liferay Portal Remote - Impl.lpkg\com.liferay.portal.remote.rest.extender-6.0.12..jar\lib 

Additional Information: 
Use of library with known vulnerability: Jettison 1.3.3