[Git][java-team/jackson-databind][master] 2 commits: Fix Debian bug #930750. CVE-2019-12814, CVE-2019-12384

[Markus Koschany]

Markus Koschany pushed to branch master at Debian Java Maintainers / jackson-databind


Commits:
74a5cd89 by Markus Koschany at 2019-06-21T22:28:08Z
Fix Debian bug #930750. CVE-2019-12814, CVE-2019-12384

- - - - -
7417a2d0 by Markus Koschany at 2019-06-21T22:30:17Z
Update changelog

- - - - -


4 changed files:

- debian/changelog
- + debian/patches/CVE-2019-12384.patch
- + debian/patches/CVE-2019-12814.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
@@ -1,3 +1,16 @@
+jackson-databind (2.9.8-3) unstable; urgency=medium
+
+  * Team upload.
+  * Fix CVE-2019-12814 and CVE-2019-12384:
+    More Polymorphic Typing issues were discovered in jackson-databind. When
+    Default Typing is enabled (either globally or for a specific property) for
+    an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x or
+    logback-core jar in the classpath, an attacker can send a specifically
+    crafted JSON message that allows them to read arbitrary local files on the
+    server. (Closes: #930750)
+
+ -- Markus Koschany <apo at debian.org>  Sat, 22 Jun 2019 00:28:48 +0200
+
 jackson-databind (2.9.8-2) unstable; urgency=medium
 
   * Team upload.


=====================================
debian/patches/CVE-2019-12384.patch
=====================================
@@ -0,0 +1,24 @@
+From: Markus Koschany <apo at debian.org>
+Date: Sat, 22 Jun 2019 00:00:02 +0200
+Subject: CVE-2019-12384
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750
+Origin: https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234
+---
+ .../com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+index a17cdf5..3dbb16e 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+@@ -83,6 +83,9 @@ public class SubTypeValidator
+         // [databind#2326] (2.9.9): one more 3rd party gadget
+         s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+ 
++        // [databind#2334] (2.9.9.1): logback-core
++        s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 


=====================================
debian/patches/CVE-2019-12814.patch
=====================================
@@ -0,0 +1,29 @@
+From: Markus Koschany <apo at debian.org>
+Date: Sat, 22 Jun 2019 00:26:32 +0200
+Subject: CVE-2019-12814
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750
+Origin: https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5
+---
+ .../fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java  | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+index 3dbb16e..72db61d 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+@@ -83,9 +83,13 @@ public class SubTypeValidator
+         // [databind#2326] (2.9.9): one more 3rd party gadget
+         s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+ 
+-        // [databind#2334] (2.9.9.1): logback-core
++        // [databind#2334]: logback-core
+         s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
+ 
++        // [databind#2341]: jdom/jdom2
++        s.add("org.jdom.transform.XSLTransformer");
++        s.add("org.jdom2.transform.XSLTransformer");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 


=====================================
debian/patches/series
=====================================
@@ -1 +1,3 @@
 CVE-2019-12086.patch
+CVE-2019-12384.patch
+CVE-2019-12814.patch



View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/190432473e29eae4813e5578dc1cd3161e93a69c...7417a2d03c304d74834bf6e70206e8be9855cf30

-- 
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/190432473e29eae4813e5578dc1cd3161e93a69c...7417a2d03c304d74834bf6e70206e8be9855cf30
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20190621/34397fe8/attachment.html>