[Git][security-tracker-team/security-tracker][master] Track more fixes for jackson-databind

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0a58cc41 by Salvatore Bonaccorso at 2026-10-16T05:00:51+02:00
Track more fixes for jackson-databind

I unmarked one bookworm entry as well along as the advisory states that
all versions starting from 2.0.0 are affected, so a LTS team member can
please reckeck?

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -32472,12 +32472,12 @@ CVE-2026-92929 (OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 tru
 CVE-2026-92928 (OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains  ...)
 	NOT-FOR-US: OpenEye Apex Network Video Recorder (NVR) firmware
 CVE-2026-91777 (Forward-reference completion for @JsonIdentityInfo object IDs in Faste ...)
-	- jackson-databind <unfixed> (bug #1148830)
+	- jackson-databind 2.18.11-1 (bug #1148830)
 	NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24
 	NOTE: https://github.com/FasterXML/jackson-databind/pull/6204
 	NOTE: Fixed by: https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67 (jackson-databind-3.2.3, jackson-databind-3.1.7, jackson-databind-2.22.3, jackson-databind-2.21.7, jackson-databind-2.18.11)
 CVE-2026-91776 (TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind ...)
-	- jackson-databind <unfixed> (bug #1148830)
+	- jackson-databind 2.18.11-1 (bug #1148830)
 	NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54
 	NOTE: https://github.com/FasterXML/jackson-databind/pull/6203
 	NOTE: Fixed by: https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577 (jackson-databind-3.2.3, jackson-databind-3.1.7, jackson-databind-2.22.3, jackson-databind-2.21.7, jackson-databind-2.18.11)
@@ -62839,7 +62839,7 @@ CVE-2026-19796 (The Listdom: AI-powered Business Directory with Classifieds Ads
 CVE-2026-19573 (The Affiliate Super Assistent plugin for WordPress is vulnerable to St ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-19032 (jackson-databind's deserializer for java.nio.file.Path resolves an att ...)
-	- jackson-databind <unfixed> (bug #1148830)
+	- jackson-databind 2.18.11-1 (bug #1148830)
 	NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf
 	NOTE: https://github.com/FasterXML/jackson-databind/pull/6129
 	NOTE: https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551 (jackson-databind-3.2.2, jackson-databind-3.1.6, jackson-databind-2.22.2, jackson-databind-2.21.6, jackson-databind-2.18.10)
@@ -136174,11 +136174,11 @@ CVE-2026-54518 (jackson-databind contains the general-purpose data-binding funct
 	NOTE: https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea (jackson-databind-3.1.4)
 CVE-2026-54517 (jackson-databind contains the general-purpose data-binding functionali ...)
 	- jackson-databind <unfixed> (bug #1145887)
-	[bookworm] - jackson-databind <not-affected> (introduced in 2.21.0; bookworm ships 2.14)
 	[bullseye] - jackson-databind <not-affected> (introduced in 2.21.0; bullseye ships 2.12)
 	NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38
 	NOTE: https://github.com/FasterXML/jackson-databind/pull/5969
 	NOTE: https://github.com/FasterXML/jackson-databind/pull/5970
+
 	NOTE: https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962 (jackson-databind-2.21.4)
 	NOTE: https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d (jackson-databind-3.1.4)
 CVE-2026-54516 (jackson-databind contains the general-purpose data-binding functionali ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a58cc41fa9087eec18948cae51819c67fa715c6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a58cc41fa9087eec18948cae51819c67fa715c6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/62ac4a13/attachment.htm>