Outdated Java library crx2oak.jar v1.10 on AEM instances

Our AEM 6.5.25 onprem instances currently host an outdated Java library crx2oak.jar v1.10 that contains multiple known vulnerabilities. Based on an initial analysis, the library does not appear to be actively used by our application, so there is no immediate risk at this time.

Goal:
We would like you to evaluate whether the library should:
a) be removed, or
b) be updated to a secure version.

Details:

• Affected library path:
  /usr/webapps/aempublish/crx-quickstart/opt/extensions/crx2oak.jar -> META-INF/maven/com.fasterxml.jackson.core/jackson-databind
• Affects both Publish and Author instances

I would like to:

1. Confirm whether this library is required by AEM or any of our current configurations/custom code.
2. Assess the impact and feasibility of removing the library if it is not in use.
3. If removal is not possible, recommend and/or apply an update to a secure, supported version of the library.