Hello, I ran Sonatype Scan against liferay 7.4 GA9 and GA13 and resulted into 1 Critical  9 High and 16 Medium. vulnerabilties. Below is the list of vulnerabilties identified in the Liferay third party jars. Our Cyber security team is asking us to get these vulnerabilites remediated or fixed. Can someone please advise when these vulnerabitlies will be remediated by Liferay? Also, could we update the jars in the share container library folder and update the depency file to remediate the vulenrabiltites?

Critical: org.codehaus.woodstox : wstx-asl : 3.2.8 - The woodstox-core package is vulnerable to Improper Restriction of XML eXternal Entity (XXE) Reference. The setFeature and getFeature methods in WstxSAXParserFactory.class rely on the mSecureProcessing boolean value to be able to securely parse input XML. The boolean value, however, is set to false by default. Additionally, the class lacks support for properties XMLConstants.FEATURE_SECURE_PROCESSING and XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, which can make it possible for an attacker to conduct XXE attacks.

High : org.springframework : spring-web : 5.2.10.RELEASE - In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

High: org.glassfish.web : javax.servlet.jsp.jstl : 1.2.3 - https://nvd.nist.gov/vuln/detail/CVE-2015-0254

High: com.liferay : org.apache.axis : 1.4.LIFERAY-PATCHED-6 - https://nvd.nist.gov/vuln/detail/CVE-2019-0227

High: com.fasterxml.jackson.core : jackson-databind : 2.12.4 - https://nvd.nist.gov/vuln/detail/CVE-2020-36518

High: org.apache.santuario : xmlsec : 1.5.8 - https://nvd.nist.gov/vuln/detail/CVE-2021-40690

High: commons-dbcp : commons-dbcp : 1.2.2 - The Apache Commons DBCP packages are vulnerable to Insufficiently Protected Credentials. The toString method in various classes as mentioned below, displays sensitive credentials. An attacker can exploit this as part of a larger attack, using said credentials to gain unauthorized access.

High: com.liferay : org.hibernate.core : 3.6.10.LIFERAY-PATCHED-6 -  https://nvd.nist.gov/vuln/detail/CVE-2020-25638

High: com.fasterxml.jackson.core : jackson-databind : 2.12.4

The jackson-databind package is vulnerable to a Denial of Service (DoS) attack. The readExternal() method in the NodeSerialization class fails to restrict allocation when JsonNode objects are serialized/deserialized by the JDK. Consequently, since the first 4 bytes of serialized JsonNode objects indicate the size of the object's contents, certain payloads with an actual byte-length of 4 may cause the application to allocate a byte array of Integer.MAX_VALUE in size (2Gb). A remote attacker can exploit this vulnerability to cause the application to consume large amounts of available heap memory by submitting a payload that exploits this issue.