[
https://issues.apache.org/jira/browse/HBASE-30282?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Xavier Fernandis updated HBASE-30282:
-------------------------------------
Description:
Upgrade jackson-jaxrs-json-provider from 2.21.1 to 2.22.3 to pull in security
fixes for jackson-databind and jackson-core.
*CVE fixes due to this upgrade :*
CVE-2026-54512
CVE-2026-54513
CVE-2026-54514
CVE-2026-54515
CVE-2026-54516
CVE-2026-54517
CVE-2026-54518
CVE-2026-59888
CVE-2026-59889
CVE-2026-77310
CVE-2026-68497
CVE-2026-19032
CVE-2026-83557
CVE-2026-91776
CVE-2026-91777
CVE-2026-68498
CVE-2026-89407
CVE-2026-89425
was:
Upgrade jackson-jaxrs-json-provider from 2.21.1 to 2.21.4 to pull in security
fixes for jackson-databind.
- CVE-2026-54512 (HIGH, CVSS 8.1) — PolymorphicTypeValidator bypass via generic
type parameters,
potentially enabling RCE
- CVE-2026-54513 (HIGH, CVSS 8.1) — allowIfSubTypeIsArray PTV bypass via
unvalidated array component
types, potentially enabling RCE
- CVE-2026-54514 (MEDIUM, CVSS 5.3) — SSRF via eager DNS resolution during
InetSocketAddress
deserialization
- CVE-2026-54516 (MEDIUM, CVSS 5.3) — @JsonIgnore bypass via renamed setter
and private field
inference
- CVE-2026-54517 (MEDIUM, CVSS 5.3) — @JsonView bypass for setterless creator
properties
- CVE-2026-54518 (MEDIUM, CVSS 6.5) — @JsonView bypass for unwrapped creator
parameters
> [hbase-thirdparty] Bump jackson-jaxrs-json-provider to 2.22.3
>
> ------------------------------------------------------------------------------------------------------
>
> Key: HBASE-30282
> URL: https://issues.apache.org/jira/browse/HBASE-30282
> Project: HBase
> Issue Type: Task
> Components: security, thirdparty
> Affects Versions: thirdparty-4.1.14
> Reporter: Xavier Fernandis
> Assignee: Xavier Fernandis
> Priority: Major
> Labels: pull-request-available
>
> Upgrade jackson-jaxrs-json-provider from 2.21.1 to 2.22.3 to pull in security
> fixes for jackson-databind and jackson-core.
>
> *CVE fixes due to this upgrade :*
> CVE-2026-54512
> CVE-2026-54513
> CVE-2026-54514
> CVE-2026-54515
> CVE-2026-54516
> CVE-2026-54517
> CVE-2026-54518
> CVE-2026-59888
> CVE-2026-59889
> CVE-2026-77310
> CVE-2026-68497
> CVE-2026-19032
> CVE-2026-83557
> CVE-2026-91776
> CVE-2026-91777
> CVE-2026-68498
> CVE-2026-89407
> CVE-2026-89425
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
