epugh opened a new pull request, #227: URL: https://github.com/apache/solr-site/pull/227
The single `2026-07-31-cve-2026-50193.md` entry bundled **six** jackson-databind issues under one range (`4.7.0-10.0.0`), one jar, and one `code_not_reachable` justification. But they have genuinely different affected-version ranges (and different rationales), so a single range/jar/justification can't represent them accurately. Split into **one file per CVE**, each scoped to exactly the Solr releases whose own **standalone** jackson-databind is in that CVE's affected range, so the generator emits only in-range product purls: | CVE | affected releases | basis | |---|---|---| | CVE-2026-54514 (SSRF, InetSocketAddress) | `9.0.0-9.10.1, 10.0.0` | not reachable — no untrusted→`InetSocketAddress` | | CVE-2026-54515 (case-insensitive `@JsonIgnoreProperties`) | `9.0.0-9.10.1, 10.0.0` | feature not used | | CVE-2026-50193 (`toString` DoS) | `9.0.0-9.1.1` | not reachable | | CVE-2026-59888 (Record `@JsonIgnore`) | `9.3.0-9.10.1, 10.0.0` | feature not used | | CVE-2026-59889 (`@JsonView`/`@JsonUnwrapped`) | `9.8.0-9.10.1` | feature not used | | GHSA-mhm7-754m-9p8w (external-type-id) | `9.8.0-9.10.1` | feature not used | Disposition stays `not_affected` throughout. Key corrections vs. the old entry: - **The SSRF (CVE-2026-54514) does affect Solr's own jackson-databind** (2.18.0 in 9.x, 2.20.0 in 10.0.0 — both below the 2.18.8/2.21.4 fixes), only patched in 9.11 (2.22.0). The old entry wrongly claimed Solr's own copy was already patched and only the Hadoop-shaded copy was affected. - **CVE-2026-50193 collapses to 9.0.0-9.1.1** — only those ship own-jackson < 2.14.0; the old `…-10.0.0` bound emitted purls for versions that aren't affected at all. - Verified each statement now emits only in-range jackson-databind purls; site builds, `vexctl merge` passes. The `hadoop-client-runtime`-shaded `2.12.7.1` copy is below the fix for the DoS/SSRF but its shaded purl can't be emitted by the generator today (same shaded-purl limitation as the SOLR-17900 avro/dnsjava/nimbus follow-up); each body notes this as a separate item. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
