You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@geode.apache.org by "JinwooHwang (via GitHub)" <gi...@apache.org> on 2026/09/04 13:41:12 UTC
[PR] [GEODE-10627] Remediation of CVE-2026-19032 [geode]
JinwooHwang opened a new pull request, #8056:
URL: https://github.com/apache/geode/pull/8056
<!-- Thank you for submitting a contribution to Apache Geode. -->Remediation of CVE-2026-19032
<!-- In order to streamline review of your contribution we ask that you
ensure you've taken the following steps. -->
### For all changes, please confirm:
- [x] Is there a JIRA ticket associated with this PR? Is it referenced in the commit message?
- [x] Has your PR been rebased against the latest commit within the target branch (typically `develop`)?
- [x] Is your initial contribution a single, squashed commit?
- [x] Does `gradlew build` run cleanly?
- [ ] Have you written or updated unit tests to verify your changes?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@geode.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [GEODE-10627] Remediation of CVE-2026-19032 [geode]
Posted by "JinwooHwang (via GitHub)" <gi...@apache.org>.
JinwooHwang commented on code in PR #8056:
URL: https://github.com/apache/geode/pull/8056#discussion_r3934710255
##########
boms/geode-all-bom/src/test/resources/expected-pom.xml:
##########
@@ -475,22 +475,22 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
- <version>2.21.5</version>
+ <version>2.21.6</version>
Review Comment:
Updated the description for the purpose of this PR. Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@geode.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [GEODE-10627] Remediation of CVE-2026-19032 [geode]
Posted by "JinwooHwang (via GitHub)" <gi...@apache.org>.
JinwooHwang commented on code in PR #8056:
URL: https://github.com/apache/geode/pull/8056#discussion_r3934659001
##########
build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy:
##########
@@ -44,9 +44,9 @@ class DependencyConstraints {
deps.put("shiro.version", "1.13.0")
deps.put("slf4j-api.version", "1.7.36")
deps.put("jboss-modules.version", "1.11.0.Final")
- deps.put("jackson.version", "2.21.5")
+ deps.put("jackson.version", "2.21.6")
deps.put("jackson.annotations.version", "2.21")
Review Comment:
Could you please share where I can find jackson.annotations version 2.21.6 and how the CVE affects jackson.annotations?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@geode.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [GEODE-10627] Remediation of CVE-2026-19032 [geode]
Posted by "JinwooHwang (via GitHub)" <gi...@apache.org>.
JinwooHwang merged PR #8056:
URL: https://github.com/apache/geode/pull/8056
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@geode.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [GEODE-10627] Remediation of CVE-2026-19032 [geode]
Posted by "utafrali (via GitHub)" <gi...@apache.org>.
utafrali commented on code in PR #8056:
URL: https://github.com/apache/geode/pull/8056#discussion_r3934606060
##########
geode-assembly/src/integrationTest/resources/assembly_content.txt:
##########
@@ -1005,10 +1005,10 @@ lib/httpclient-4.5.13.jar
lib/httpcore-4.4.15.jar
lib/istack-commons-runtime-4.0.1.jar
lib/jackson-annotations-2.21.jar
-lib/jackson-core-2.21.5.jar
-lib/jackson-databind-2.21.5.jar
-lib/jackson-datatype-joda-2.21.5.jar
-lib/jackson-datatype-jsr310-2.21.5.jar
+lib/jackson-core-2.21.6.jar
Review Comment:
The assembled distribution still ships `jackson-annotations-2.21.jar` while every sibling Jackson jar is now at 2.21.6. This is a direct consequence of the version constraint above. If this is intentional, no change is needed here, but the reason should be documented in the PR description or as a comment in `DependencyConstraints.groovy` so future maintainers understand the version skew.
##########
boms/geode-all-bom/src/test/resources/expected-pom.xml:
##########
@@ -475,22 +475,22 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
- <version>2.21.5</version>
+ <version>2.21.6</version>
Review Comment:
The PR description contains no information about what CVE-2026-19032 actually affects (e.g., deserialization in `jackson-databind`, parsing in `jackson-core`, etc.). Without that context, reviewers cannot confirm whether this four-artifact version bump is complete or whether additional Jackson modules (e.g., `jackson-dataformat-yaml`, which is also pinned via `jackson.version`) are also in scope. Please add a brief description of the vulnerability surface so the fix can be evaluated on its merits.
##########
build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy:
##########
@@ -44,9 +44,9 @@ class DependencyConstraints {
deps.put("shiro.version", "1.13.0")
deps.put("slf4j-api.version", "1.7.36")
deps.put("jboss-modules.version", "1.11.0.Final")
- deps.put("jackson.version", "2.21.5")
+ deps.put("jackson.version", "2.21.6")
deps.put("jackson.annotations.version", "2.21")
Review Comment:
`jackson.annotations.version` stays at `"2.21"` while `jackson.version` and `jackson.databind.version` both move to `2.21.6`. The annotations module lives in the same `com.fasterxml.jackson.core` group as the two modules being patched. For a CVE remediation, it needs to be explicit whether CVE-2026-19032 does not affect `jackson-annotations` (in which case a comment here explains why this key is intentionally left behind), or whether `jackson-annotations-2.21.6` has not been released (in which case a follow-up ticket should be created). As written, a reviewer cannot distinguish intentional scoping from an oversight.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@geode.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org