Sandor Molnar created KNOX-3383:
-----------------------------------
Summary: Bump jackson to 2.18.9 due to CVEs
Key: KNOX-3383
URL: https://issues.apache.org/jira/browse/KNOX-3383
Project: Apache Knox
Issue Type: Task
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.0.0
The {{jackson}} dependencies have to be upgraded to at least 2.18.9 due to
multiple CVEs:
{noformat}
[
{
"cve_id": "CVE-2026-54512",
"severity": "HIGH",
"cvss": 8.1,
"description": "jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.10.0 until
2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is
the primary safety mechanism guarding polymorphic deserialization. When
polymorphic typing is enabled and a type identifier contains generic parameters
(i.e. the type ID string contains <),
DatabindContext._resolveAndValidateGeneric() validates only the raw container
class name (the substring before <) against the configured PTV. If the
container type is approved, the method parses the full canonical type string
via TypeFactory.constructFromCanonical() and returns the fully parameterized
type without ever validating the nested type arguments against the PTV. The
nested type arguments are then resolved, instantiated, and populated as beans
during deserialization. An attacker who controls the type ID can therefore
place a denied class as a generic type parameter of an allowed container — for
example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is
allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via
Class.forName(name, true, loader), instantiated, and its properties are set
from attacker-controlled JSON. This completely bypasses an explicitly
configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and
3.1.4.",
"published_date": "2026-06-23",
"package": "jackson-databind",
"version": "2.18.6",
"fixed_in": "2.18.8, 2.21.4, 3.1.4",
"epss_score": null,
"epss_percentile": null,
"risk_score": 50,
"risk_level": "high",
"jira_key": "",
"jira_status": "",
"kev": false
},
{
"cve_id": "CVE-2026-54513",
"severity": "HIGH",
"cvss": 8.1,
"description": "jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.10.0 until
2.18.8, 2.21.4, and 3.1.4,
BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any
array type based only on clazz.isArray(), without validating the array's
component (element) type against the configured allowlist. A PTV built with
allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore
still permits EvilType[] even though EvilType is not allowlisted. When Jackson
deserializes the elements and no per-element type IDs are present, it
instantiates the component type directly with no further PTV check, bypassing
the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
"published_date": "2026-06-23",
"package": "jackson-databind",
"version": "2.18.6",
"fixed_in": "2.18.8, 2.21.4, 3.1.4",
"epss_score": null,
"epss_percentile": null,
"risk_score": 50,
"risk_level": "high",
"jira_key": "",
"jira_status": "",
"kev": false
},
{
"cve_id": "CVE-2026-54514",
"severity": "MEDIUM",
"cvss": 5.3,
"description": "jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.0.0 until
2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed
InetSocketAddress with new InetSocketAddress(host, port), which performs eager
DNS name resolution for hostname inputs at deserialization time. An application
that binds untrusted JSON into a type containing an InetSocketAddress field
issues an attacker-chosen DNS query during readValue, before any
application-level validation or connect logic. The fix uses
InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit
connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
"published_date": "2026-06-23",
"package": "jackson-databind",
"version": "2.18.6",
"fixed_in": "2.18.8, 2.21.4, 3.1.4",
"epss_score": null,
"epss_percentile": null,
"risk_score": 30,
"risk_level": "medium",
"jira_key": "",
"jira_status": "",
"kev": false
},
{
"cve_id": "CVE-2026-54515",
"severity": "MEDIUM",
"cvss": 5.3,
"description": "jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.8.0 until
2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(),
per-property @JsonIgnoreProperties exclusions are applied by
_handleByNameInclusion(), producing a contextual deserializer whose
BeanPropertyMap has the ignored properties removed. The subsequent per-property
case-insensitivity block (triggered by
@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from
this._beanProperties (the original, unfiltered map) instead of
contextual._beanProperties, then overwrites the filtered map — restoring every
property _handleByNameInclusion had just removed. The ignored property becomes
writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.",
"published_date": "2026-06-23",
"package": "jackson-databind",
"version": "2.18.6",
"fixed_in": "2.18.9, 2.21.5, 2.22.1, 3.1.4",
"epss_score": null,
"epss_percentile": null,
"risk_score": 30,
"risk_level": "medium",
"jira_key": "",
"jira_status": "",
"kev": false
}
]{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
