[
https://issues.apache.org/jira/browse/CASSANDRA-21717?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18119176#comment-18119176
]
Kapil Shewate commented on CASSANDRA-21717:
-------------------------------------------
Is Cassandra 5.0.7+ vulnerable to the above CVE's.
> CVE-2026-54512.jackson-databind contains the general-purpose data-binding
> functionality and tree-model for Jackson Data Processor.
> ----------------------------------------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-21717
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21717
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Kapil Shewate
> Priority: Normal
>
> CVEID: CVE-2026-54512
> Description: jackson-databind contains the general-purpose data-binding
> functionality and tree-model for Jackson Data Processor. From 2.10.0 until
> 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV)
> is the primary safety mechanism guarding polymorphic deserialization. When
> polymorphic typing is enabled and a type identifier contains generic
> parameters (i.e. the type ID string contains <),
> DatabindContext._resolveAndValidateGeneric() validates only the raw container
> class name (the substring before <) against the configured PTV. If the
> container type is approved, the method parses the full canonical type string
> via TypeFactory.constructFromCanonical() and returns the fully parameterized
> type without ever validating the nested type arguments against the PTV. The
> nested type arguments are then resolved, instantiated, and populated as beans
> during deserialization. An attacker who controls the type ID can therefore
> place a denied class as a generic type parameter of an allowed container —
> for example java.util.ArrayList<com.evil.Gadget> when only
> java.util.ArrayList is allow-listed. The container passes the PTV check;
> com.evil.Gadget is loaded via Class.forName(name, true, loader),
> instantiated, and its properties are set from attacker-controlled JSON. This
> completely bypasses an explicitly configured PTV allow-list. This
> vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
> CWE: CWE-184: Incomplete List of Disallowed Inputs
> CVSS Source: [email protected]
> CVSS Base Score: 8.1
> CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
