JinwooHwang opened a new pull request, #8015: URL: https://github.com/apache/geode/pull/8015
This pull request upgrades the jackson-core dependency to mitigate GHSA-2m67-wjpj-xhg9. This critical issue involves a document length constraint bypass where blocking, async, and DataInput parsers could accept oversized JSON documents, weakening denial-of-service protections. ### Changes Updated jackson-core to the latest secure version to ensure StreamReadConstraints and maxDocumentLength are consistently enforced. ### Security Impact - Vulnerability: GHSA-2m67-wjpj-xhg9 (CVSS 7.5) - Description: Jackson's parsers previously failed to enforce configured document length constraints on the final in-memory buffer or end-of-input, allowing large documents to bypass configured limits and consume excessive CPU/memory. - Resolution: This update ensures maxDocumentLength validation executes properly across all parser pathways, effectively restoring Denial of Service (DoS) protections. ### Verification Verified that all blocking, async, and DataInput parsers properly throw a StreamConstraintsException when payloads exceed StreamReadConstraints.getMaxDocumentLength(). <!-- Thank you for submitting a contribution to Apache Geode. --> <!-- In order to streamline review of your contribution we ask that you ensure you've taken the following steps. --> ### For all changes, please confirm: - [x] Is there a JIRA ticket associated with this PR? Is it referenced in the commit message? - [x] Has your PR been rebased against the latest commit within the target branch (typically `develop`)? - [x] Is your initial contribution a single, squashed commit? - [x] Does `gradlew build` run cleanly? - [ ] Have you written or updated unit tests to verify your changes? - [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
