You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ji...@apache.org on 2026/08/03 15:46:02 UTC
(geode) branch support/1.15 updated: Remediation of CVE-2026-54513 (#8026)
This is an automated email from the ASF dual-hosted git repository.
JinwooHwang pushed a commit to branch support/1.15
in repository https://gitbox.apache.org/repos/asf/geode.git
The following commit(s) were added to refs/heads/support/1.15 by this push:
new 1f8e583e20 Remediation of CVE-2026-54513 (#8026)
1f8e583e20 is described below
commit 1f8e583e20e5b8c6c948ebdc8f5c097f23393002
Author: Jinwoo Hwang <92...@users.noreply.github.com>
AuthorDate: Mon Aug 3 11:45:57 2026 -0400
Remediation of CVE-2026-54513 (#8026)
---
.../src/test/resources/expected-pom.xml | 8 +--
.../gradle/plugins/DependencyConstraints.groovy | 4 +-
.../integrationTest/resources/assembly_content.txt | 8 +--
.../resources/gfsh_dependency_classpath.txt | 8 +--
.../resources/dependency_classpath.txt | 8 +--
pull-requests/GEODE-10576.md | 63 ----------------------
6 files changed, 18 insertions(+), 81 deletions(-)
diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml
index 4d09214554..f74c21fa60 100644
--- a/boms/geode-all-bom/src/test/resources/expected-pom.xml
+++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml
@@ -475,22 +475,22 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
- <version>2.21.2</version>
+ <version>2.21.5</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
- <version>2.21.2</version>
+ <version>2.21.5</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-joda</artifactId>
- <version>2.21.2</version>
+ <version>2.21.5</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jsr310</artifactId>
- <version>2.21.2</version>
+ <version>2.21.5</version>
</dependency>
<dependency>
<groupId>com.jayway.jsonpath</groupId>
diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
index b0f3b78389..2385b65353 100644
--- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
+++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
@@ -44,9 +44,9 @@ class DependencyConstraints {
deps.put("shiro.version", "1.13.0")
deps.put("slf4j-api.version", "1.7.36")
deps.put("jboss-modules.version", "1.11.0.Final")
- deps.put("jackson.version", "2.21.2")
+ deps.put("jackson.version", "2.21.5")
deps.put("jackson.annotations.version", "2.21")
- deps.put("jackson.databind.version", "2.21.2")
+ deps.put("jackson.databind.version", "2.21.5")
deps.put("springshell.version", "1.2.0.RELEASE")
deps.put("springframework.version", "5.3.20")
diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt
index 134859ac1d..baf12ed3bc 100644
--- a/geode-assembly/src/integrationTest/resources/assembly_content.txt
+++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt
@@ -1005,10 +1005,10 @@ lib/httpclient-4.5.13.jar
lib/httpcore-4.4.15.jar
lib/istack-commons-runtime-4.0.1.jar
lib/jackson-annotations-2.21.jar
-lib/jackson-core-2.21.2.jar
-lib/jackson-databind-2.21.2.jar
-lib/jackson-datatype-joda-2.21.2.jar
-lib/jackson-datatype-jsr310-2.21.2.jar
+lib/jackson-core-2.21.5.jar
+lib/jackson-databind-2.21.5.jar
+lib/jackson-datatype-joda-2.21.5.jar
+lib/jackson-datatype-jsr310-2.21.5.jar
lib/javax.activation-api-1.2.0.jar
lib/javax.mail-api-1.6.2.jar
lib/javax.resource-api-1.7.1.jar
diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
index 0d906b581e..8a1502ea48 100644
--- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
+++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
@@ -21,11 +21,11 @@ spring-shell-1.2.0.RELEASE.jar
spring-web-5.3.20.jar
commons-lang3-3.12.0.jar
rmiio-2.1.2.jar
-jackson-datatype-joda-2.21.2.jar
+jackson-datatype-joda-2.21.5.jar
jackson-annotations-2.21.jar
-jackson-core-2.21.2.jar
-jackson-datatype-jsr310-2.21.2.jar
-jackson-databind-2.21.2.jar
+jackson-core-2.21.5.jar
+jackson-datatype-jsr310-2.21.5.jar
+jackson-databind-2.21.5.jar
swagger-annotations-2.2.1.jar
jopt-simple-5.0.4.jar
log4j-slf4j-impl-2.25.4.jar
diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
index 643743b249..560fb1de6d 100644
--- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
+++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
@@ -9,7 +9,7 @@ spring-jcl-5.3.20.jar
commons-codec-1.15.jar
classgraph-4.8.147.jar
commons-logging-1.3.5.jar
-jackson-databind-2.21.2.jar
+jackson-databind-2.21.5.jar
geode-management-0.0.0.jar
geode-core-0.0.0.jar
javax.activation-api-1.2.0.jar
@@ -44,7 +44,7 @@ rmiio-2.1.2.jar
geode-tcp-server-0.0.0.jar
log4j-jcl-2.25.4.jar
geode-connectors-0.0.0.jar
-jackson-core-2.21.2.jar
+jackson-core-2.21.5.jar
jetty-util-9.4.57.v20241219.jar
log4j-slf4j-impl-2.25.4.jar
lucene-analyzers-common-6.6.6.jar
@@ -87,7 +87,7 @@ antlr-2.7.7.jar
jetty-xml-9.4.57.v20241219.jar
geode-rebalancer-0.0.0.jar
jetty-server-9.4.57.v20241219.jar
-jackson-datatype-jsr310-2.21.2.jar
-jackson-datatype-joda-2.21.2.jar
+jackson-datatype-jsr310-2.21.5.jar
+jackson-datatype-joda-2.21.5.jar
joda-time-2.10.14.jar
byte-buddy-1.14.9.jar
\ No newline at end of file
diff --git a/pull-requests/GEODE-10576.md b/pull-requests/GEODE-10576.md
deleted file mode 100644
index 49d2a3b754..0000000000
--- a/pull-requests/GEODE-10576.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# GEODE-10576: Remediation of security vulnerability (GHSA-2m67-wjpj-xhg9)
-
-**Base branch:** `support/1.15`
-
-## Summary
-
-Upgrade Jackson libraries from 2.17.0 to 2.21.2 to address a high-severity security vulnerability in `jackson-core`.
-
-- `jackson-core`, `jackson-databind`, `jackson-dataformat-yaml`, `jackson-datatype-joda`, `jackson-datatype-jsr310`: 2.17.0 → 2.21.2
-- `jackson-annotations`: 2.17.0 → 2.21 (aligned with upstream release versioning)
-
-## Security Vulnerability
-
-| Field | Value |
-|---|---|
-| Snyk ID | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 |
-| Type | Allocation of Resources Without Limits or Throttling (CWE-770) |
-| Severity | 8.7 HIGH (CVSS v4.0) |
-| Affected Package | com.fasterxml.jackson.core:jackson-core |
-| Affected Versions | [2.8.0, 2.21.2) |
-| Fixed Version | 2.21.2 |
-| Disclosed | 4 Apr 2026 |
-| Published | 5 Apr 2026 |
-
-### Description
-
-Affected versions of `jackson-core` are vulnerable to Allocation of Resources Without Limits or Throttling in the
-enforcement of document length constraints in blocking, async, and DataInput
-parser processes. An attacker can cause excessive resource consumption by submitting
-oversized JSON documents that bypass configured size limits.
-
-### References
-
-- [GitHub Issue #1570](https://github.com/FasterXML/jackson-core/issues/1570)
-- [Maintainer's Advisory (GHSA-2m67-wjpj-xhg9)](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-2m67-wjpj-xhg9)
-- [Fix Commit 74c9ee2](https://github.com/FasterXML/jackson-core/commit/74c9ee255d1534c179bc7d3de48941bf39a9079c)
-- [Fix Commit 7ce3622](https://github.com/FasterXML/jackson-core/commit/7ce3622f40e66bd821b5184d6055d8493afac5f3)
-
-## Changes
-
-| File | Description |
-|---|---|
-| DependencyConstraints.groovy | Updated jackson.version and jackson.databind.version to 2.21.2; added separate jackson.annotations.version set to 2.21 |
-| GeodeJsonMapper.java | Replaced deprecated `ObjectMapper.setSerializationInclusion()` with `setDefaultPropertyInclusion()` |
-| JQFilterVerificationDUnitTest.java | Replaced deprecated `JsonNode.fields()` with `properties().iterator()` |
-| assembly_content.txt | Updated Jackson jar filenames to new versions |
-| gfsh_dependency_classpath.txt | Updated Jackson jar filenames to new versions |
-| dependency_classpath.txt | Updated Jackson jar filenames to new versions |
-| expected-pom.xml | Updated Jackson dependency versions in BOM |
-
-## Testing
-
-- `build` — compiles successfully
-- `test` — unit tests pass (7477 tests completed, 1 pre-existing failure unrelated to Jackson)
-
-### For all changes, please confirm:
-
-- [x] Is there a JIRA ticket associated with this PR? Is it referenced in the commit message?
-- [x] Has your PR been rebased against the latest commit within the target branch (typically `support/1.15`)?
-- [x] Is your initial contribution a single, squashed commit?
-- [x] Does `gradlew build` run cleanly?
-- [x] Have you written or updated unit tests to verify your changes?
-- [x] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?