SOLR-16568: Update FasterXML Woodstox to 6.4.0

[kiratraynor]

https://issues.apache.org/jira/browse/SOLR-16568

Description

This was brought up on the mailing list here: https://lists.apache.org/thread/psc4r75o933y22jos4xk5rcwhof48sdw

The automatically created CVEs against xstream are misleading and read the thread above to try to find out more. Its not clear which CVEs if any are actually valid.

The only one that looks still valid against woodstox-core is CVE-2022-40152 (GHSA-3f7h-mf4q-vrm4) and fixed in FasterXML/woodstox#160. It is LOW severity only.

Solution

Update the com.fasterxml.woodstox:woodstox-core dependency to 6.4.0 where there are no longer any vulnerabilities.

Tests

After running the existing tests, there is no need for any code changes for this upgraded version of woodstox.

Checklist

Please review the following and check all that apply:

• I have reviewed the guidelines for How to Contribute and my code conforms to the standards described there to the best of my ability.
• I have created a Jira issue and added the issue ID to my pull request title.
• I have given Solr maintainers access to contribute to my PR branch. (optional but recommended)
• I have developed this patch against the main branch.
• I have run ./gradlew check.
• I have added tests for my changes.
• I have added documentation for the Reference Guide

[risdenk]

Thanks @kiratraynor - the change looks good. I think the only thing this is missing is a solr/CHANGES.txt entry. I can add one or you can add one if you want.

[kiratraynor]

@risdenk Thanks for the reply! I'm updating the solr/CHANGES.txt file now, adding the change to the 'Other Changes Section'. Let me know if this is incorrect.