[Git][java-team/jackson-databind][jessie] Import Debian changes 2.4.2-2+deb8u5
Markus Koschany
gitlab at salsa.debian.org
Thu May 16 21:40:10 BST 2019
Markus Koschany pushed to branch jessie at Debian Java Maintainers / jackson-databind
Commits:
b3b70e6f by Markus Koschany at 2019-05-16T20:20:42Z
Import Debian changes 2.4.2-2+deb8u5
jackson-databind (2.4.2-2+deb8u5) jessie-security; urgency=high
* Non-maintainer upload by the LTS team.
* Fix CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718,
CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360,
CVE-2018-19361 and CVE-2018-19362.
Several deserialization flaws were discovered in jackson-databind which
could allow an unauthenticated user to perform code execution. The issue
was resolved by extending the blacklist and blocking more classes from
polymorphic deserialization.
- - - - -
6 changed files:
- debian/changelog
- + debian/patches/CVE-2018-11307.patch
- + debian/patches/CVE-2018-12022.patch
- + debian/patches/CVE-2018-14718.patch
- + debian/patches/CVE-2018-19360.patch
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,16 @@
+jackson-databind (2.4.2-2+deb8u5) jessie-security; urgency=high
+
+ * Non-maintainer upload by the LTS team.
+ * Fix CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718,
+ CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360,
+ CVE-2018-19361 and CVE-2018-19362.
+ Several deserialization flaws were discovered in jackson-databind which
+ could allow an unauthenticated user to perform code execution. The issue
+ was resolved by extending the blacklist and blocking more classes from
+ polymorphic deserialization.
+
+ -- Markus Koschany <apo at debian.org> Mon, 04 Mar 2019 10:30:09 +0100
+
jackson-databind (2.4.2-2+deb8u4) jessie-security; urgency=high
* Team upload.
=====================================
debian/patches/CVE-2018-11307.patch
=====================================
@@ -0,0 +1,23 @@
+From: Markus Koschany <apo at debian.org>
+Date: Mon, 4 Mar 2019 10:14:17 +0100
+Subject: CVE-2018-11307
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2032
+Origin: https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb737
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index e797666..8977968 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -85,6 +85,8 @@ public class BeanDeserializerFactory
+ // [databind#1899]: more 3rd party
+ s.add("org.hibernate.jmx.StatisticsService");
+ s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
++ // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities
++ s.add("org.apache.ibatis.parsing.XPathParser");
+
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
=====================================
debian/patches/CVE-2018-12022.patch
=====================================
@@ -0,0 +1,29 @@
+From: Markus Koschany <apo at debian.org>
+Date: Mon, 4 Mar 2019 10:15:16 +0100
+Subject: CVE-2018-12022
+
+This is also the fix for CVE-2018-12023.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2052
+Origin: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 8977968..f1b1eac 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -88,6 +88,12 @@ public class BeanDeserializerFactory
+ // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities
+ s.add("org.apache.ibatis.parsing.XPathParser");
+
++ // [databind#2052]: ldap approaches; in all cases LDAP connection String is passed
++ // and access attempt is made:
++ s.add("oracle.jdbc.connector.OracleManagedConnectionFactory");
++ s.add("jodd.db.connection.DataSourceConnectionProvider");
++ s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/CVE-2018-14718.patch
=====================================
@@ -0,0 +1,29 @@
+From: Markus Koschany <apo at debian.org>
+Date: Mon, 4 Mar 2019 10:20:06 +0100
+Subject: CVE-2018-14718
+
+This is also the fix for CVE-2018-14719, CVE-2018-14720, CVE-2018-14721.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2097
+Origin: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index f1b1eac..dd8a8f2 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -94,6 +94,12 @@ public class BeanDeserializerFactory
+ s.add("jodd.db.connection.DataSourceConnectionProvider");
+ s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
+
++ // [databind#2097]: some 3rd party, one JDK-bundled
++ s.add("org.slf4j.ext.EventData");
++ s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
++ s.add("com.sun.deploy.security.ruleset.DRSHelper");
++ s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/CVE-2018-19360.patch
=====================================
@@ -0,0 +1,29 @@
+From: Markus Koschany <apo at debian.org>
+Date: Mon, 4 Mar 2019 10:23:11 +0100
+Subject: CVE-2018-19360
+
+This is also the fix for CVE-2018-19361 and CVE-2018-19362.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
+Origin: https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index dd8a8f2..fe24bae 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -100,6 +100,12 @@ public class BeanDeserializerFactory
+ s.add("com.sun.deploy.security.ruleset.DRSHelper");
+ s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
++ // [databind#2186]: yet more 3rd party gadgets
++ s.add("org.jboss.util.propertyeditor.DocumentEditor");
++ s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
++ s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
++ s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/series
=====================================
@@ -6,3 +6,7 @@ CVE-2017-15095_3.patch
CVE-2018-5968.patch
CVE-2017-17485.patch
CVE-2018-7489.patch
+CVE-2018-11307.patch
+CVE-2018-12022.patch
+CVE-2018-14718.patch
+CVE-2018-19360.patch
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/commit/b3b70e6fe2fd6295bae492ff0af867948555a75f
--
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/commit/b3b70e6fe2fd6295bae492ff0af867948555a75f
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20190516/9e02474b/attachment.html>
More information about the pkg-java-commits
mailing list