You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2026/07/17 13:19:00 UTC
[jira] [Work logged] (KNOX-3383) Bump jackson to 2.18.9 due to CVEs
[ https://issues.apache.org/jira/browse/KNOX-3383?focusedWorklogId=1030939&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1030939 ]
ASF GitHub Bot logged work on KNOX-3383:
----------------------------------------
Author: ASF GitHub Bot
Created on: 17/Jul/26 13:18
Start Date: 17/Jul/26 13:18
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1310:
URL: https://github.com/apache/knox/pull/1310
[KNOX-3383](https://issues.apache.org/jira/browse/KNOX-3383) - Bump Jackson to 2.18.9 due to CVEs
## What changes were proposed in this pull request?
Bumped Jackson version to 2.18.9
## How was this patch tested?
Built and deployed locally.
Relying on unit tests and Docker-based integration tests.
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1030939)
Remaining Estimate: 0h
Time Spent: 10m
> Bump jackson to 2.18.9 due to CVEs
> ----------------------------------
>
> Key: KNOX-3383
> URL: https://issues.apache.org/jira/browse/KNOX-3383
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The {{jackson}} dependencies have to be upgraded to at least 2.18.9 due to multiple CVEs:
> {noformat}
> [
> {
> "cve_id": "CVE-2026-54512",
> "severity": "HIGH",
> "cvss": 8.1,
> "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.8, 2.21.4, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 50,
> "risk_level": "high",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> },
> {
> "cve_id": "CVE-2026-54513",
> "severity": "HIGH",
> "cvss": 8.1,
> "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.8, 2.21.4, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 50,
> "risk_level": "high",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> },
> {
> "cve_id": "CVE-2026-54514",
> "severity": "MEDIUM",
> "cvss": 5.3,
> "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.8, 2.21.4, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 30,
> "risk_level": "medium",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> },
> {
> "cve_id": "CVE-2026-54515",
> "severity": "MEDIUM",
> "cvss": 5.3,
> "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.9, 2.21.5, 2.22.1, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 30,
> "risk_level": "medium",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> }
> ]{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)