[Git][java-team/jackson-databind][jessie] 11 commits: Imported Upstream version 2.7.3

Markus Koschany gitlab at salsa.debian.org
Thu May 3 16:27:35 BST 2018


Markus Koschany pushed to branch jessie at Debian Java Maintainers / jackson-databind


Commits:
76df0b74 by Emmanuel Bourg at 2016-04-08T13:55:28+02:00
Imported Upstream version 2.7.3
- - - - -
95b820d2 by Emmanuel Bourg at 2016-05-13T10:08:28+02:00
Imported Upstream version 2.7.4
- - - - -
bb24ae81 by Emmanuel Bourg at 2016-12-15T15:41:21+01:00
New upstream version 2.8.5
- - - - -
9967d154 by Emmanuel Bourg at 2017-01-16T01:48:31+01:00
New upstream version 2.8.6
- - - - -
3278dfe0 by Markus Koschany at 2017-10-12T00:25:49+02:00
New upstream version 2.9.1
- - - - -
de050fc9 by Markus Koschany at 2018-01-25T14:43:01+01:00
New upstream version 2.9.4
- - - - -
b615b58b by Markus Koschany at 2018-03-27T17:33:31+02:00
New upstream version 2.9.5
- - - - -
4a9cb30a by Markus Koschany at 2018-05-01T19:17:02+02:00
Import Upstream version 2.4.2
- - - - -
6740cafd by Markus Koschany at 2018-05-01T19:17:07+02:00
Import Debian changes 2.4.2-2+deb8u3

jackson-databind (2.4.2-2+deb8u3) jessie-security; urgency=high

  * Team upload.
  * Fix CVE-2017-17485 and CVE-2018-5968:
    Bybass of deserialization blackist to disallow unauthenticated remote code
    execution. These CVE exist due to an incomplete fix for CVE-2017-7525.
    (Closes: #888316, #888318)

jackson-databind (2.4.2-2+deb8u2) jessie-security; urgency=high

  * Team upload
  * CVE-2017-15095: incomplete fixes for CVE-2017-7525

- - - - -
2bf099f1 by Markus Koschany at 2018-05-01T19:19:57+02:00
Fix CVE-2018-7489

- - - - -
3062d842 by Markus Koschany at 2018-05-01T19:21:18+02:00
Update changelog

- - - - -


9 changed files:

- debian/changelog
- + debian/gbp.conf
- + debian/patches/CVE-2017-15095_1.patch
- + debian/patches/CVE-2017-15095_2.patch
- + debian/patches/CVE-2017-15095_3.patch
- + debian/patches/CVE-2017-17485.patch
- + debian/patches/CVE-2018-5968.patch
- + debian/patches/CVE-2018-7489.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,31 @@
+jackson-databind (2.4.2-2+deb8u4) jessie-security; urgency=high
+
+  * Team upload.
+  * Fix CVE-2018-7489: allows unauthenticated remote code execution because of
+    an incomplete fix for the CVE-2017-7525 deserialization flaw. This is
+    exploitable by sending maliciously crafted JSON input to the readValue
+    method of the ObjectMapper, bypassing a blacklist that is ineffective if
+    the c3p0 libraries are available in the classpath. (Closes: #891614)
+
+ -- Markus Koschany <apo at debian.org>  Tue, 01 May 2018 19:20:38 +0200
+
+jackson-databind (2.4.2-2+deb8u3) jessie-security; urgency=high
+
+  * Team upload.
+  * Fix CVE-2017-17485 and CVE-2018-5968:
+    Bybass of deserialization blackist to disallow unauthenticated remote code
+    execution. These CVE exist due to an incomplete fix for CVE-2017-7525.
+    (Closes: #888316, #888318)
+
+ -- Markus Koschany <apo at debian.org>  Sat, 27 Jan 2018 19:37:47 +0100
+
+jackson-databind (2.4.2-2+deb8u2) jessie-security; urgency=high
+
+  * Team upload
+  * CVE-2017-15095: incomplete fixes for CVE-2017-7525
+
+ -- Sebastien Delafond <seb at debian.org>  Thu, 16 Nov 2017 09:13:27 +0100
+
 jackson-databind (2.4.2-2+deb8u1) jessie-security; urgency=high
 
   * Team upload.


=====================================
debian/gbp.conf
=====================================
--- /dev/null
+++ b/debian/gbp.conf
@@ -0,0 +1,2 @@
+[buildpackage]
+compression = gz


=====================================
debian/patches/CVE-2017-15095_1.patch
=====================================
--- /dev/null
+++ b/debian/patches/CVE-2017-15095_1.patch
@@ -0,0 +1,26 @@
+From: Tatu Saloranta <tatu.saloranta at iki.fi>
+Date: Wed, 26 Apr 2017 20:22:25 -0700
+Subject: Minor improvement wrt #1599 (also cover vanilla xalan impl)
+Origin: https://github.com/FasterXML/jackson-databind//commit/3bfbb835e530055c1941ddf87fde0b08d08dcd38
+Bug: https://github.com/FasterXML/jackson-databind/issues/1599
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-15095
+
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java    | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index cbbb90c2b..586513ddd 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -57,6 +57,7 @@ public class BeanDeserializerFactory
+         s.add("org.codehaus.groovy.runtime.MethodClosure");
+         s.add("org.springframework.beans.factory.ObjectFactory");
+         s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
++        s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 
+-- 
+2.15.0.rc2
+


=====================================
debian/patches/CVE-2017-15095_2.patch
=====================================
--- /dev/null
+++ b/debian/patches/CVE-2017-15095_2.patch
@@ -0,0 +1,23 @@
+From: Tatu Saloranta <tatu.saloranta at iki.fi>
+Date: Fri, 30 Jun 2017 09:30:13 -0700
+Subject: Fix #1680
+Origin: https://github.com/FasterXML/jackson-databind//commit/e8f043d1aac9b82eee907e0f0c3abbdea723a935
+Bug: https://github.com/FasterXML/jackson-databind/issues/1680
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-15095
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 586513ddd..f2244e0c3 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -58,6 +58,8 @@ public class BeanDeserializerFactory
+         s.add("org.springframework.beans.factory.ObjectFactory");
+         s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
+         s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
++        // [databind#1680]: may or may not be problem, take no chance
++        s.add("com.sun.rowset.JdbcRowSetImpl");
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 
+-- 
+2.15.0.rc2
+


=====================================
debian/patches/CVE-2017-15095_3.patch
=====================================
--- /dev/null
+++ b/debian/patches/CVE-2017-15095_3.patch
@@ -0,0 +1,161 @@
+From: Tatu Saloranta <tatu.saloranta at iki.fi>
+Date: Thu, 17 Aug 2017 15:12:47 -0700
+Subject: Fix #1737
+Origin: https://github.com/FasterXML/jackson-databind//commit/ddfddfba6414adbecaff99684ef66eebd3a92e92
+Bug: https://github.com/FasterXML/jackson-databind/issues/1737
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-15095
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 9850cf75c..9301c666a 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -49,7 +49,7 @@ public class BeanDeserializerFactory
+     static {
+         Set<String> s = new HashSet<>();
+         // Courtesy of [https://github.com/kantega/notsoserial]:
+-        // (and wrt [databind#1599]
++        // (and wrt [databind#1599])
+         s.add("org.apache.commons.collections.functors.InvokerTransformer");
+         s.add("org.apache.commons.collections.functors.InstantiateTransformer");
+         s.add("org.apache.commons.collections4.functors.InvokerTransformer");
+@@ -61,6 +61,15 @@ public class BeanDeserializerFactory
+         s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
+         // [databind#1680]: may or may not be problem, take no chance
+         s.add("com.sun.rowset.JdbcRowSetImpl");
++        // [databind#1737]; JDK provided
++        s.add("java.util.logging.FileHandler");
++        s.add("java.rmi.server.UnicastRemoteObject");
++        // [databind#1737]; 3rd party
++        s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
++        s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
++        s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
++        s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 
+diff --git a/src/test/java/com/fasterxml/jackson/databind/interop/IllegalTypesCheckTest.java b/src/test/java/com/fasterxml/jackson/databind/interop/IllegalTypesCheckTest.java
+index 1906eadb6..8721b9b6a 100644
+--- a/src/test/java/com/fasterxml/jackson/databind/interop/IllegalTypesCheckTest.java
++++ b/src/test/java/com/fasterxml/jackson/databind/interop/IllegalTypesCheckTest.java
+@@ -1,5 +1,6 @@
+ package com.fasterxml.jackson.databind.interop;
+ 
++import com.fasterxml.jackson.annotation.JsonTypeInfo;
+ import com.fasterxml.jackson.databind.*;
+ 
+ /**
+@@ -12,12 +13,29 @@ public class IllegalTypesCheckTest extends BaseMapTest
+         public int id;
+         public Object obj;
+     }
++
++    static class PolyWrapper {
++        @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS,
++                include = JsonTypeInfo.As.WRAPPER_ARRAY)
++        public Object v;
++    }
+     
+-    public void testIssue1599() throws Exception
++    /*
++    /**********************************************************
++    /* Unit tests
++    /**********************************************************
++     */
++
++    private final ObjectMapper MAPPER = objectMapper();
++    
++    // // // Tests for [databind#1599]
++
++    public void testXalanTypes1599() throws Exception
+     {
++        final String clsName = "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl";
+         final String JSON = aposToQuotes(
+  "{'id': 124,\n"
+-+" 'obj':[ 'com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl',\n"
+++" 'obj':[ '"+clsName+"',\n"
+ +"  {\n"
+ +"    'transletBytecodes' : [ 'AAIAZQ==' ],\n"
+ +"    'transletName' : 'a.b',\n"
+@@ -32,9 +50,75 @@ public class IllegalTypesCheckTest extends BaseMapTest
+             mapper.readValue(JSON, Bean1599.class);
+             fail("Should not pass");
+         } catch (JsonMappingException e) {
+-            verifyException(e, "Illegal type");
+-            verifyException(e, "to deserialize");
+-            verifyException(e, "prevented for security reasons");
++            _verifySecurityException(e, clsName);
++        }
++    }
++
++    // // // Tests for [databind#1737]
++
++    public void testJDKTypes1737() throws Exception
++    {
++        _testTypes1737(java.util.logging.FileHandler.class);
++        _testTypes1737(java.rmi.server.UnicastRemoteObject.class);
++    }
++
++    // 17-Aug-2017, tatu: Ideally would test handling of 3rd party types, too,
++    //    but would require adding dependencies. This may be practical when
++    //    checking done by module, but for now let's not do that for databind.
++
++    /*
++    public void testSpringTypes1737() throws Exception
++    {
++        _testTypes1737("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
++        _testTypes1737("org.springframework.beans.factory.config.PropertyPathFactoryBean");
++    }
++
++    public void testC3P0Types1737() throws Exception
++    {
++        _testTypes1737("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
++        _testTypes1737("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
++    }
++    */
++
++    private void _testTypes1737(Class<?> nasty) throws Exception {
++        _testTypes1737(nasty.getName());
++    }
++
++    private void _testTypes1737(String clsName) throws Exception
++    {
++        // While usually exploited via default typing let's not require
++        // it here; mechanism still the same
++        String json = aposToQuotes(
++                "{'v':['"+clsName+"','/tmp/foobar.txt']}"
++                );
++        try {
++            MAPPER.readValue(json, PolyWrapper.class);
++            fail("Should not pass");
++        } catch (JsonMappingException e) {
++            _verifySecurityException(e, clsName);
++        }
++    }
++
++    protected void _verifySecurityException(Throwable t, String clsName) throws Exception
++    {
++        // 17-Aug-2017, tatu: Expected type more granular in 2.9 (over 2.8)
++        _verifyException(t, JsonMappingException.class,
++            "Illegal type",
++            "to deserialize",
++            "prevented for security reasons");
++        verifyException(t, clsName);
++    }
++
++    protected void _verifyException(Throwable t, Class<?> expExcType,
++            String... patterns) throws Exception
++    {
++        Class<?> actExc = t.getClass();
++        if (!expExcType.isAssignableFrom(actExc)) {
++            fail("Expected Exception of type '"+expExcType.getName()+"', got '"
++                    +actExc.getName()+"', message: "+t.getMessage());
++        }
++        for (String pattern : patterns) {
++            verifyException(t, pattern);
+         }
+     }
+ }
+-- 
+2.15.0.rc2
+


=====================================
debian/patches/CVE-2017-17485.patch
=====================================
--- /dev/null
+++ b/debian/patches/CVE-2017-17485.patch
@@ -0,0 +1,75 @@
+From: Markus Koschany <apo at debian.org>
+Date: Sat, 27 Jan 2018 20:16:02 +0100
+Subject: CVE-2017-17485
+
+Bug-Debian: https://bugs.debian.org/888318
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/1855
+Origin: https://github.com/FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d
+Origin: https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf
+Origin: https://github.com/FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd
+---
+ .../databind/deser/BeanDeserializerFactory.java    | 37 +++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 5 deletions(-)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index c536b46..9b56b08 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -38,6 +38,8 @@ public class BeanDeserializerFactory
+ {
+     private static final long serialVersionUID = 1;
+ 
++    protected final static String PREFIX_STRING = "org.springframework.";
++
+     /**
+      * Signature of <b>Throwable.initCause</b> method.
+      */
+@@ -75,6 +77,9 @@ public class BeanDeserializerFactory
+         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
+         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
+         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
++        // [databind#1855]: more 3rd party
++        s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
++        s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
+         // [databind#1899]: more 3rd party
+         s.add("org.hibernate.jmx.StatisticsService");
+         s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
+@@ -932,11 +937,33 @@ public class BeanDeserializerFactory
+     {
+         // There are certain nasty classes that could cause problems, mostly
+         // via default typing -- catch them here.
+-        String full = type.getRawClass().getName();
+ 
+-        if (_cfgIllegalClassNames.contains(full)) {
+-            throw new JsonMappingException("Illegal type (" + full + ") to deserialize: prevented for security reasons");
+-        }
+-    }
++        final Class<?> raw = type.getRawClass();
++        String full = raw.getName();
++
++        main_check:
++        do {
++            if (_cfgIllegalClassNames.contains(full)) {
++                break;
++            }
++
++            // 18-Dec-2017, tatu: As per [databind#1855], need bit more sophisticated handling
++           //    for some Spring framework types
++            if (full.startsWith(PREFIX_STRING)) {
++                for (Class<?> cls = raw; cls != Object.class; cls = cls.getSuperclass()) {
++                    String name = cls.getSimpleName();
++                    // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
++                    if ("AbstractPointcutAdvisor".equals(name)
++                            // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
++                            || "AbstractApplicationContext".equals(name)) {
++                        break main_check;
++                    }
++                }
++            }
++            return;
++        } while (false);
++
++        throw new JsonMappingException("Illegal type (" + full + ") to deserialize: prevented for security reasons");
++     }
+ 
+ }


=====================================
debian/patches/CVE-2018-5968.patch
=====================================
--- /dev/null
+++ b/debian/patches/CVE-2018-5968.patch
@@ -0,0 +1,25 @@
+From: Markus Koschany <apo at debian.org>
+Date: Sat, 27 Jan 2018 19:00:33 +0100
+Subject: CVE-2018-5968
+
+Bug-Debian: https://bugs.debian.org/888316
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/1899
+Origin: https://github.com/FasterXML/jackson-databind/commit/038b471e2efde2e8f96b4e0be958d3e5a1ff1d05
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java  | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 86b5c08..10ada70 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -69,6 +69,9 @@ public class BeanDeserializerFactory
+         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
+         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
+         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
++        // [databind#1899]: more 3rd party
++        s.add("org.hibernate.jmx.StatisticsService");
++        s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
+ 
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }


=====================================
debian/patches/CVE-2018-7489.patch
=====================================
--- /dev/null
+++ b/debian/patches/CVE-2018-7489.patch
@@ -0,0 +1,51 @@
+From: Markus Koschany <apo at debian.org>
+Date: Tue, 1 May 2018 19:17:40 +0200
+Subject: CVE-2018-7489
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891614
+Origin: https://github.com/FasterXML/jackson-databind/commit/6799f8f10cc78e9af6d443ed6982d00a13f2e7d2
+---
+ .../jackson/databind/deser/BeanDeserializerFactory.java  | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 9b56b08..e797666 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -40,6 +40,8 @@ public class BeanDeserializerFactory
+ 
+     protected final static String PREFIX_STRING = "org.springframework.";
+ 
++    protected final static String PREFIX_C3P0 = "com.mchange.v2.c3p0.";
++
+     /**
+      * Signature of <b>Throwable.initCause</b> method.
+      */
+@@ -75,8 +77,8 @@ public class BeanDeserializerFactory
+         // [databind#1737]; 3rd party
+         s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
+         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
+-        s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
+-        s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
++//        s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); // deprecated by [databind#1931]
++//        s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); // - "" -
+         // [databind#1855]: more 3rd party
+         s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
+         s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
+@@ -959,6 +961,16 @@ public class BeanDeserializerFactory
+                         break main_check;
+                     }
+                 }
++            } else if (full.startsWith(PREFIX_C3P0)) {
++                // [databind#1737]; more 3rd party
++                // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
++                // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
++                // [databind#1931]; more 3rd party
++                // com.mchange.v2.c3p0.ComboPooledDataSource
++                // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource
++                if (full.endsWith("DataSource")) {
++                    break main_check;
++                }
+             }
+             return;
+         } while (false);


=====================================
debian/patches/series
=====================================
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,8 @@
 fix-using-bundle.diff
 CVE-2017-7525.patch
+CVE-2017-15095_1.patch
+CVE-2017-15095_2.patch
+CVE-2017-15095_3.patch
+CVE-2018-5968.patch
+CVE-2017-17485.patch
+CVE-2018-7489.patch



View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/c1bc818a6ba603b1a7a9451070ea0eee3e48a01e...3062d842e3505c1fea7eaa8540fc8c2a9686f846

---
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/c1bc818a6ba603b1a7a9451070ea0eee3e48a01e...3062d842e3505c1fea7eaa8540fc8c2a9686f846
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20180503/4c980468/attachment.html>


More information about the pkg-java-commits mailing list