[Git][java-team/jackson-databind][master] 6 commits: Keep writeValueAsString() source compatible in CVE-2025-52999.patch
Emmanuel Bourg (@ebourg)
gitlab at salsa.debian.org
Wed Oct 14 13:03:29 BST 2026
Emmanuel Bourg pushed to branch master at Debian Java Maintainers / jackson-databind
Commits:
7d487ece by Juan Manuel Méndez Rey at 2026-10-03T02:56:40+02:00
Keep writeValueAsString() source compatible in CVE-2025-52999.patch
Follow upstream commit 71003893a (jackson-databind 2.15.0): move
getAndClear() into the existing try block, so its IOException is
rethrown as JsonMappingException and the throws clause stays
JsonProcessingException as in upstream 2.14.
- - - - -
84dcecb0 by Juan Manuel Méndez Rey at 2026-10-03T03:01:19+02:00
d/changelog: close #1139511 and #1142111
- - - - -
999c00ce by Emmanuel Bourg at 2026-10-14T13:58:22+02:00
Standards-Version updated to 4.7.4
- - - - -
0f4371f3 by Emmanuel Bourg at 2026-10-14T13:58:22+02:00
Removed the Priority field
- - - - -
0d38c788 by Emmanuel Bourg at 2026-10-14T13:58:22+02:00
Removed the Rules-Requires-Root field
- - - - -
f2148ff9 by Emmanuel Bourg at 2026-10-14T14:00:25+02:00
Upload to unstable
- - - - -
3 changed files:
- debian/changelog
- debian/control
- debian/patches/CVE-2025-52999.patch
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,18 @@
+jackson-databind (2.14.0+ds-3) unstable; urgency=medium
+
+ * Team upload.
+
+ [ Juan Manuel Méndez Rey ]
+ * Keep writeValueAsString() source compatible in CVE-2025-52999.patch
+ (Closes: #1139511, #1142111)
+
+ [ Emmanuel Bourg ]
+ * Standards-Version updated to 4.7.4
+ * Removed the Priority field
+ * Removed the Rules-Requires-Root field
+
+ -- Emmanuel Bourg <ebourg at apache.org> Wed, 14 Oct 2026 14:00:25 +0200
+
jackson-databind (2.14.0+ds-2) unstable; urgency=medium
[ Otto Kekäläinen ]
=====================================
debian/control
=====================================
@@ -1,6 +1,5 @@
Source: jackson-databind
Section: java
-Priority: optional
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Uploaders:
Markus Koschany <apo at debian.org>,
@@ -20,8 +19,7 @@ Build-Depends:
libreplacer-java,
maven-debian-helper (>= 1.6.5),
xmlstarlet
-Standards-Version: 4.7.0
-Rules-Requires-Root: no
+Standards-Version: 4.7.4
Vcs-Git: https://salsa.debian.org/java-team/jackson-databind.git
Vcs-Browser: https://salsa.debian.org/java-team/jackson-databind
Homepage: https://github.com/FasterXML/jackson/wiki/
=====================================
debian/patches/CVE-2025-52999.patch
=====================================
@@ -3,37 +3,56 @@ Date: Sat, 6 Jun 2026 14:04:23 +0200
Subject: CVE-2025-52999
Related to CVE-2025-52999.patch in jackson-core. Fixes a FTBFS.
+.
+The jackson-core fix makes SegmentedStringWriter.getAndClear() throw
+IOException. The first version of this patch added IOException to the
+throws clause of ObjectMapper.writeValueAsString() and
+ObjectWriter.writeValueAsString(), which broke source compatibility for
+callers that only catch JsonProcessingException. Use the upstream 2.15.0
+change instead: call getAndClear() inside the existing try block, so an
+IOException is rethrown as JsonMappingException and the public signatures
+stay as in upstream 2.14.
+Origin: upstream, https://github.com/FasterXML/jackson-databind/commit/71003893a583da54e9a2b0fe619da64449bca673
+Applied-Upstream: 2.15.0
Bug-Debian: https://bugs.debian.org/1135410
Forwarded: not-needed
+Backported-by: Juan Manuel Méndez Rey <juan.mendezr at proton.me>
+Last-Update: 2026-10-02
---
- src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java | 2 +-
- src/main/java/com/fasterxml/jackson/databind/ObjectWriter.java | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
diff --git a/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java b/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java
-index d16d83a..87a07ab 100644
+index d16d83a..60c996e 100644
--- a/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java
+++ b/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java
-@@ -3861,7 +3861,7 @@ public class ObjectMapper
- * Note: prior to version 2.1, throws clause included {@link IOException}; 2.1 removed it.
- */
- public String writeValueAsString(Object value)
-- throws JsonProcessingException
-+ throws JsonProcessingException, IOException
- {
- // alas, we have to pull the recycler directly here...
+@@ -3867,12 +3867,12 @@ public class ObjectMapper
SegmentedStringWriter sw = new SegmentedStringWriter(_jsonFactory._getBufferRecycler());
+ try {
+ _writeValueAndClose(createGenerator(sw), value);
++ return sw.getAndClear();
+ } catch (JsonProcessingException e) {
+ throw e;
+ } catch (IOException e) { // shouldn't really happen, but is declared as possibility so:
+ throw JsonMappingException.fromUnexpectedIOE(e);
+ }
+- return sw.getAndClear();
+ }
+
+ /**
diff --git a/src/main/java/com/fasterxml/jackson/databind/ObjectWriter.java b/src/main/java/com/fasterxml/jackson/databind/ObjectWriter.java
-index 744d17f..890b855 100644
+index 744d17f..8d3fc5a 100644
--- a/src/main/java/com/fasterxml/jackson/databind/ObjectWriter.java
+++ b/src/main/java/com/fasterxml/jackson/databind/ObjectWriter.java
-@@ -1132,7 +1132,7 @@ public class ObjectWriter
- * Note: prior to version 2.1, throws clause included {@link IOException}; 2.1 removed it.
- */
- public String writeValueAsString(Object value)
-- throws JsonProcessingException
-+ throws JsonProcessingException, IOException
- {
- // alas, we have to pull the recycler directly here...
+@@ -1138,12 +1138,12 @@ public class ObjectWriter
SegmentedStringWriter sw = new SegmentedStringWriter(_generatorFactory._getBufferRecycler());
+ try {
+ _writeValueAndClose(createGenerator(sw), value);
++ return sw.getAndClear();
+ } catch (JsonProcessingException e) {
+ throw e;
+ } catch (IOException e) { // shouldn't really happen, but is declared as possibility so:
+ throw JsonMappingException.fromUnexpectedIOE(e);
+ }
+- return sw.getAndClear();
+ }
+
+ /**
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/-/compare/7878b04ee66484663b586178fb46904bebed4635...f2148ff9e5821f97b23fdb2a0a98d5ecf5175d6c
--
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/-/compare/7878b04ee66484663b586178fb46904bebed4635...f2148ff9e5821f97b23fdb2a0a98d5ecf5175d6c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20261014/8a1d7bd8/attachment.htm>
More information about the pkg-java-commits
mailing list