Update jackson-databind to 2.8.11.4

[racevedoo]

Upgrade to 2.8.11.4 for security reasons. From jackson release notes:

[elasticmachine]

Pinging @elastic/es-core-features (:Core/Features/Ingest)

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Build)

[cbuescher]

Maybe related: #45225

[davydotcom]

any update on this? This is holding up closing critical CVEs for highly secure environments

[davydotcom]

I was able to merge this into 7.4.2 tag branch and build myself and verify functionality works. I'd happily live with building my own non snapshot 7.4.2 with this fix but it wants a license key for xpack to do that

[jakelandis]

@elasticmachine ok to test

[jakelandis]

@elasticmachine update branch

[jakelandis]

@racevedoo thanks for the PR. I updated the SHA hashes and will get this merged and backported.

FWIW, it does not appear that Elasticsearch is susceptible to any of the CVEs referenced.

[davydotcom]

Yay Thanks. While it may not be susceptible, it still shows up on a scan for CAT 1 level security issues. This can cause immediate rejection even if the software is not vulnerable directly.

[ywelsch]

The backport PR seems to have been merged. I'm therefore removing the backport pending label here. Please shout if this is incorrect