Merge 1.5.3 changes back to master.

extensions/guacamole-auth-json/pom.xml

@@ -77,7 +77,7 @@
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-web</artifactId>
-            <version>5.8.2</version>
+            <version>5.8.3</version>
         </dependency>
 
     </dependencies>

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml

@@ -74,6 +74,23 @@
             <groupId>com.onelogin</groupId>
             <artifactId>java-saml</artifactId>
             <version>2.9.0</version>
+            <!--
+                Replace vulnerable version of Woodstox until upstream
+                releases a version with fixed dependencies
+            -->
+            <exclusions>
+                <exclusion>
+                    <groupId>com.fasterxml.woodstox</groupId>
+                    <artifactId>woodstox-core</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+
+        <!-- Woodstox -->
+        <dependency>
+            <groupId>com.fasterxml.woodstox</groupId>
+            <artifactId>woodstox-core</artifactId>
+            <version>5.4.0</version>
         </dependency>
 
     </dependencies>