[
https://issues.apache.org/jira/browse/KNOX-3383?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar resolved KNOX-3383.
---------------------------------
Resolution: Fixed
> Bump jackson to 2.18.9 due to CVEs
> ----------------------------------
>
> Key: KNOX-3383
> URL: https://issues.apache.org/jira/browse/KNOX-3383
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> The {{jackson}} dependencies have to be upgraded to at least 2.18.9 due to
> multiple CVEs:
> {noformat}
> [
> {
> "cve_id": "CVE-2026-54512",
> "severity": "HIGH",
> "cvss": 8.1,
> "description": "jackson-databind contains the general-purpose
> data-binding functionality and tree-model for Jackson Data Processor. From
> 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's
> PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding
> polymorphic deserialization. When polymorphic typing is enabled and a type
> identifier contains generic parameters (i.e. the type ID string contains <),
> DatabindContext._resolveAndValidateGeneric() validates only the raw container
> class name (the substring before <) against the configured PTV. If the
> container type is approved, the method parses the full canonical type string
> via TypeFactory.constructFromCanonical() and returns the fully parameterized
> type without ever validating the nested type arguments against the PTV. The
> nested type arguments are then resolved, instantiated, and populated as beans
> during deserialization. An attacker who controls the type ID can therefore
> place a denied class as a generic type parameter of an allowed container —
> for example java.util.ArrayList<com.evil.Gadget> when only
> java.util.ArrayList is allow-listed. The container passes the PTV check;
> com.evil.Gadget is loaded via Class.forName(name, true, loader),
> instantiated, and its properties are set from attacker-controlled JSON. This
> completely bypasses an explicitly configured PTV allow-list. This
> vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.8, 2.21.4, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 50,
> "risk_level": "high",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> },
> {
> "cve_id": "CVE-2026-54513",
> "severity": "HIGH",
> "cvss": 8.1,
> "description": "jackson-databind contains the general-purpose
> data-binding functionality and tree-model for Jackson Data Processor. From
> 2.10.0 until 2.18.8, 2.21.4, and 3.1.4,
> BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any
> array type based only on clazz.isArray(), without validating the array's
> component (element) type against the configured allowlist. A PTV built with
> allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore
> still permits EvilType[] even though EvilType is not allowlisted. When
> Jackson deserializes the elements and no per-element type IDs are present, it
> instantiates the component type directly with no further PTV check, bypassing
> the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.8, 2.21.4, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 50,
> "risk_level": "high",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> },
> {
> "cve_id": "CVE-2026-54514",
> "severity": "MEDIUM",
> "cvss": 5.3,
> "description": "jackson-databind contains the general-purpose
> data-binding functionality and tree-model for Jackson Data Processor. From
> 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed
> InetSocketAddress with new InetSocketAddress(host, port), which performs
> eager DNS name resolution for hostname inputs at deserialization time. An
> application that binds untrusted JSON into a type containing an
> InetSocketAddress field issues an attacker-chosen DNS query during readValue,
> before any application-level validation or connect logic. The fix uses
> InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit
> connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.8, 2.21.4, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 30,
> "risk_level": "medium",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> },
> {
> "cve_id": "CVE-2026-54515",
> "severity": "MEDIUM",
> "cvss": 5.3,
> "description": "jackson-databind contains the general-purpose
> data-binding functionality and tree-model for Jackson Data Processor. From
> 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in
> BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties
> exclusions are applied by _handleByNameInclusion(), producing a contextual
> deserializer whose BeanPropertyMap has the ignored properties removed. The
> subsequent per-property case-insensitivity block (triggered by
> @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from
> this._beanProperties (the original, unfiltered map) instead of
> contextual._beanProperties, then overwrites the filtered map — restoring
> every property _handleByNameInclusion had just removed. The ignored property
> becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and
> 3.1.4.",
> "published_date": "2026-06-23",
> "package": "jackson-databind",
> "version": "2.18.6",
> "fixed_in": "2.18.9, 2.21.5, 2.22.1, 3.1.4",
> "epss_score": null,
> "epss_percentile": null,
> "risk_score": 30,
> "risk_level": "medium",
> "jira_key": "",
> "jira_status": "",
> "kev": false
> }
> ]{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
