[From nobody Thu Oct 15 14:09:14 2026 Received: (at 1145887-close) by bugs.debian.org; 15 Oct 2026 13:07:18 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,HAS_BUG_NUMBER, MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 150; neutral, 253; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:56436) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xHLB0-00AnPJ-0D for 1145887-close@bugs.debian.org; Thu, 15 Oct 2026 13:07:18 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xHLAx-006Wur-32 for 1145887-close@bugs.debian.org; Thu, 15 Oct 2026 13:07:15 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=yaILJYMmkr35j5T0uXW9oGY7+x3RU3pJ6Op98iK73vk=; b=YwUyQbtfp1WQovor/C32g7+mOF 9MX5IzBJwPHYNRhFhr4N/ybZ1UsMJVA/oWAnTRBu87weXlhlNTDyNgLcBOtuU/dZ737tTj3szrX0V IVY6NkprnKfC0AWm/MZVK5Wl/8fwXYzHAWS+tjX4YPm8nn+fTM49P5wugLC0ksVeHyaWjE6AalzGz uIvVaDqDi8VoY7sStIjk0lFxEDJaMPFmsNO/KspHdsg/EVL6QiTxZNbTxD/GgyosbkFPQfUN+SbHZ oHBxiNZCSPzXrdai279Y7pE2ONhMIbwXHNg0z5qopfrei/3P82DNMc7D9rEG3DfVZPDLCp5iKu9OQ 2VS7Jwwg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xHLAw-00000002vQ9-2y77; Thu, 15 Oct 2026 13:07:14 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Emmanuel Bourg <ebourg@apache.org> To: 1145887-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: jackson-databind Debian: DAK Debian-Changes: jackson-databind_2.18.11-1_source.changes Debian-Source: jackson-databind Debian-Version: 2.18.11-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1145887: fixed in jackson-databind 2.18.11-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0215869875585962458==" Message-Id: <E1xHLAw-00000002vQ9-2y77@fasolo.debian.org> Date: Thu, 15 Oct 2026 13:07:14 +0000 X-CrossAssassin-Score: 3 --===============0215869875585962458== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: jackson-databind Source-Version: 2.18.11-1 Done: Emmanuel Bourg <ebourg@apache.org> We believe that the bug you reported is fixed in the latest version of jackson-databind, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1145887@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Emmanuel Bourg <ebourg@apache.org> (supplier of updated jackson-databind pack= age) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 15 Oct 2026 09:28:11 +0200 Source: jackson-databind Architecture: source Version: 2.18.11-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Emmanuel Bourg <ebourg@apache.org> Closes: 1145887 1146640 1147507 Changes: jackson-databind (2.18.11-1) unstable; urgency=3Dmedium . * Team upload. * New upstream release - Fixes CVE-2026-54512, CVE-2026-54513, CVE-2026-54514 and CVE-2026-54515 (Closes: #1145887) - Fixes CVE-2026-83557: Comparable was missing from the unsafe base types of DefaultBaseTypeLimitingValidator (Closes: #1146640) - Fixes CVE-2026-68497: the XML datatype deserializers did not bound the length of stringified numbers (Closes: #1147507) - Updated the Maven rules - Removed the patches, no longer needed - Tightened the dependencies on jackson-core and jackson-annotations * Converted debian/watch to the version 5 format Checksums-Sha1: ba3831fa45c2dbf1ef1667d067ed5e1ab4603a50 2427 jackson-databind_2.18.11-1.dsc 4e114dbb08c9b92c162ced5a1d7a84d7633a7bd8 1170644 jackson-databind_2.18.11.or= ig.tar.xz f18d3c14478cad2d79000c1d9b4007e6c259a05d 7804 jackson-databind_2.18.11-1.deb= ian.tar.xz dcb098e82e26b554b2e8ead1d8f1c76d573c3cc0 20099 jackson-databind_2.18.11-1_so= urce.buildinfo Checksums-Sha256: 0b0c8dc995a1cf78b19a68650dab0f160608f3b420e7d8a9a9ce0a1c8724da23 2427 jackso= n-databind_2.18.11-1.dsc 7953119f3ebf50c226fdb8fbe88455b193584ceefb7cd9454ab1a6695d231628 1170644 jac= kson-databind_2.18.11.orig.tar.xz 19356d3a80146bc1b19aa6d5a5afa2e6dfb924891253cbf6de22715a54628648 7804 jackso= n-databind_2.18.11-1.debian.tar.xz c4fe24ba350344e2dbfefa6442cc4978884bce9f3f9564790a0e0ab972410eb4 20099 jacks= on-databind_2.18.11-1_source.buildinfo Files: d514eb00bf94bd721b73ce68c12a6c96 2427 java optional jackson-databind_2.18.11= -1.dsc 057a642aa2a319add0ea4f864e08b321 1170644 java optional jackson-databind_2.18= .11.orig.tar.xz 108ff1d3cc42a393aa75c88aee0e9f2c 7804 java optional jackson-databind_2.18.11= -1.debian.tar.xz a73e70765d2dbae7d6e1023de3c20547 20099 java optional jackson-databind_2.18.1= 1-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQzG4SHGVib3VyZ0Bh cGFjaGUub3JnAAoJEPUTxBnkudCsDFIQAJTLxLe2bJjhQa0NS/Lj/8LOMzuGXD6x lPmxacmX3pjqevjiK/SWuE62Q7c0hZnGDNwl2don0V7rLcHmU3R/x5LHcpMC1i6e 6tlmdPuQMgRShionp71/r649DvaCrT9c2cixTEJnwgODsEjR9Qu0+bfEz0LMS0P/ BF9eZ3KathkaPARxWCbeNTBV+6eAd3jE+GjutaAOI5B14Ne03camT3gLADXtecjf 352CVv4lNCMBB1ehzdOq5l43qjYvIiBPf7JY262pBsY17tyuu9nFuPfswowXQNky 15t30OfGrHjsY99VWa3a0CNYNKck1ilKey7UMW/tNEGw7PuW1voshi3UeDC08gO8 Mcujiw56qGHxlhciGjXJ9e7GUOA3QnVrQgorpB1Co4CoBefhQsVOfMg1NLv5nrXS 78Edig/J6NHXi5Q+8xRnBL3eYVXaioIzO2VdadNKmDEAxU3ooBX52MRQ9k31WAhn CqtYc+TNeH5CPqWL40zaYIuSC02ni2DMmoeee8ewE5jEmyA0jrz14BBOJfP1gLnW 8fOln1h9D6IYUdDXCaOfglKAumlUP+QCcivgLogTtQx7kIooOdjmEFmf5vL0biJA ZQ8GeY5aIaQneP0d8JPZXkWOuvAxlSfHhK8bI7e+4ssuCLwqlKP4+k4WuOwi2eMj vL8c01hft3zz =3DIr20 -----END PGP SIGNATURE----- --===============0215869875585962458== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCatDQAgAKCRCb9qggYcy5 IUh/AP0fMcCW0AMfs7dPxI8xIR5Sh4ca8Xz+CXFwDqqBhbOhYwD9HI3s9XCdQxiZ rjj4wE8MSDotTSgw0d+6/Zf9jPpVDwg= =Hrh3 -----END PGP SIGNATURE----- --===============0215869875585962458==-- ]