[Git][java-team/jackson-databind][jessie] Import Debian changes 2.4.2-2+deb8u7

[Markus Koschany]

Markus Koschany pushed to branch jessie at Debian Java Maintainers / jackson-databind


Commits:
49053a29 by Markus Koschany at 2019-06-21T12:29:00Z
Import Debian changes 2.4.2-2+deb8u7

jackson-databind (2.4.2-2+deb8u7) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * More Polymorphic Typing issues were discovered in jackson-databind. When
    Default Typing is enabled (either globally or for a specific property) for an
    externally exposed JSON endpoint and the service has JDOM 1.x or 2.x or
    logback-core jar in the classpath, an attacker can send a specifically
    crafted JSON message that allows them to read arbitrary local files on the
    server.

- - - - -


4 changed files:

- debian/changelog
- + debian/patches/CVE-2019-12384.patch
- + debian/patches/CVE-2019-12814.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
@@ -1,3 +1,15 @@
+jackson-databind (2.4.2-2+deb8u7) jessie-security; urgency=high
+
+  * Non-maintainer upload by the LTS team.
+  * More Polymorphic Typing issues were discovered in jackson-databind. When
+    Default Typing is enabled (either globally or for a specific property) for an
+    externally exposed JSON endpoint and the service has JDOM 1.x or 2.x or
+    logback-core jar in the classpath, an attacker can send a specifically
+    crafted JSON message that allows them to read arbitrary local files on the
+    server.
+
+ -- Markus Koschany <apo at debian.org>  Fri, 21 Jun 2019 14:16:32 +0200
+
 jackson-databind (2.4.2-2+deb8u6) jessie-security; urgency=high
 
   * Non-maintainer upload by the LTS team.


=====================================
debian/patches/CVE-2019-12384.patch
=====================================
@@ -0,0 +1,24 @@
+From: Markus Koschany <apo at debian.org>
+Date: Fri, 21 Jun 2019 14:07:20 +0200
+Subject: CVE-2019-12384
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750
+Origin: https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java  | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 0ed0d5e..a79b829 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -109,6 +109,9 @@ public class BeanDeserializerFactory
+         // [databind#2326] (2.9.9): one more 3rd party gadget
+         s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+ 
++        // [databind#2334] (2.9.9.1): logback-core
++        s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 


=====================================
debian/patches/CVE-2019-12814.patch
=====================================
@@ -0,0 +1,29 @@
+From: Markus Koschany <apo at debian.org>
+Date: Fri, 21 Jun 2019 14:14:41 +0200
+Subject: CVE-2019-12814
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750
+Origin: https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java   | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index a79b829..be487b3 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -109,9 +109,13 @@ public class BeanDeserializerFactory
+         // [databind#2326] (2.9.9): one more 3rd party gadget
+         s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+ 
+-        // [databind#2334] (2.9.9.1): logback-core
++        // [databind#2334]: logback-core
+         s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
+ 
++        // [databind#2341]: jdom/jdom2
++        s.add("org.jdom.transform.XSLTransformer");
++        s.add("org.jdom2.transform.XSLTransformer");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 


=====================================
debian/patches/series
=====================================
@@ -11,3 +11,5 @@ CVE-2018-12022.patch
 CVE-2018-14718.patch
 CVE-2018-19360.patch
 CVE-2019-12086.patch
+CVE-2019-12384.patch
+CVE-2019-12814.patch



View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/commit/49053a29c26056c7d323f2aff096502e92f79406

-- 
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/commit/49053a29c26056c7d323f2aff096502e92f79406
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20190621/a99685f7/attachment.html>