fix CVE-2023-42503 by using Apache Commons Compress 1.24.0

[alwibrm]

Apache Commons Compress 1.22 is vulnerable to CVE-2023-42503. Fix by using version 1.24.0.

[KalleOlaviNiemitalo]

The vulnerability reportedly affects only applications that use CompressorStreamFactory, TarArchiveInputStream, or TarFile. The Avro source code has never referenced any of those classes, so the vulnerability seems impossible to exploit via Avro.

No comment on whether this PR should be merged.

[Fokko]

@alwibrm Thanks for raising this PR 👍

@KalleOlaviNiemitalo Thanks for tracking that down, that's very helpful. I think it is good to get this in any way to keep up to date. Also, probably people will get false positive CVE alerts if they have this dependency being pulled in.

[clesaec]

👍

[clesaec]

@alwibrm : Is there any JIRA associated with this PR ? If not, could you create one ? (or i can do it if you want).
(JIRA is usefull to follow change in project)

[alwibrm]

@clesaec I have not created a Jira issue for this. Yesterday I intended to do so and realized too late that there was a self service for registration. I would appreciate when you would create one, thank you very much.

[clesaec]

i created this JIRA and merge this PR