Emmanuel Bourg pushed to tag debian/2.14.1-2 at Debian Java Maintainers /
jackson-core
Commits:
812698d9 by Markus Koschany at 2026-10-14T18:23:50+02:00
Import Debian changes 2.14.1-2
jackson-core (2.14.1-2) unstable; urgency=medium
.
* Team upload.
.
[ Markus Koschany and Emmanuel Arias ]
* CVE-2025-52999:
A limit was added to avoid a StackoverflowError if the parsed JSON is very
deeply nested. The StackoverflowError issue happens in jackson-databind but
this change in jackson-core stops it from happening unless you increase the
StreamReadConstraints.maxNestingDepth() to a high number. (Closes:
#1108367).
* Declare compliance with Debian Policy 4.7.4.
- - - - -
4 changed files:
- debian/changelog
- debian/control
- + debian/patches/CVE-2025-52999.patch
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,17 @@
+jackson-core (2.14.1-2) unstable; urgency=medium
+
+ * Team upload.
+
+ [ Markus Koschany and Emmanuel Arias ]
+ * CVE-2025-52999:
+ A limit was added to avoid a StackoverflowError if the parsed JSON is very
+ deeply nested. The StackoverflowError issue happens in jackson-databind but
+ this change in jackson-core stops it from happening unless you increase the
+ StreamReadConstraints.maxNestingDepth() to a high number. (Closes:
#1108367).
+ * Declare compliance with Debian Policy 4.7.4.
+
+ -- Markus Koschany <[email protected]> Wed, 15 Apr 2026 13:27:34 +0200
+
jackson-core (2.14.1-1) unstable; urgency=medium
* Team upload.
=====================================
debian/control
=====================================
@@ -16,7 +16,7 @@ Build-Depends-Indep:
libmaven-bundle-plugin-java,
libmaven-enforcer-plugin-java,
libreplacer-java
-Standards-Version: 4.6.2
+Standards-Version: 4.7.4
Rules-Requires-Root: no
Vcs-Git: https://salsa.debian.org/java-team/jackson-core.git
Vcs-Browser: https://salsa.debian.org/java-team/jackson-core
=====================================
debian/patches/CVE-2025-52999.patch
=====================================
The diff for this file was not included because it is too large.
=====================================
debian/patches/series
=====================================
@@ -1,2 +1,3 @@
02-skip-jacoco.patch
01-no-bundle.patch
+CVE-2025-52999.patch
View it on GitLab:
https://salsa.debian.org/java-team/jackson-core/-/commit/812698d9203e1a132af89392e8698ed6880354f9
--
View it on GitLab:
https://salsa.debian.org/java-team/jackson-core/-/commit/812698d9203e1a132af89392e8698ed6880354f9
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
pkg-java-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-commits
