[Git][security-tracker-team/security-tracker][master] Add two jackson-databind issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c0a06a15 by Salvatore Bonaccorso at 2026-07-15T11:44:08+02:00
Add two jackson-databind issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -69,9 +69,16 @@ CVE-2026-5040 (TP-Link Deco M5 v1 uses a weak password hashing mechanism to stor
 CVE-2026-59891 (sigstore-js provides JavaScript libraries for interacting with Sigstor ...)
 	TODO: check
 CVE-2026-59889 (jackson-databind contains the general-purpose data-binding functionali ...)
-	TODO: check
+	- jackson-databind <not-affected> (Vulnerable code introduced later)
+	NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh
+	NOTE: https://github.com/FasterXML/jackson-databind/issues/6060
+	NOTE: https://github.com/FasterXML/jackson-databind/pull/6056
+	NOTE: Fixed by: https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b (jackson-databind-2.18.9)
 CVE-2026-59888 (jackson-databind contains the general-purpose data-binding functionali ...)
-	TODO: check
+	- jackson-databind <not-affected> (Vulnerable code introduced later)
+	NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5
+	NOTE: https://github.com/FasterXML/jackson-databind/pull/5974
+	NOTE: Fixed by: https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d (jackson-databind-2.18.8)
 CVE-2026-59886 (pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ ...)
 	- pyasn1 <unfixed>
 	NOTE: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0a06a151fae8909fd8ab1fffc2bcd2826bd939c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0a06a151fae8909fd8ab1fffc2bcd2826bd939c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260715/8f0d52d6/attachment.htm>