[Git][java-team/jackson-databind][stretch] 3 commits: Import Debian changes 2.8.6-1+deb9u5
Markus Koschany
gitlab at salsa.debian.org
Thu May 23 18:58:48 BST 2019
Markus Koschany pushed to branch stretch at Debian Java Maintainers / jackson-databind
Commits:
c5b13dc7 by Markus Koschany at 2019-05-18T21:52:15Z
Import Debian changes 2.8.6-1+deb9u5
jackson-databind (2.8.6-1+deb9u5) stretch-security; urgency=high
* Team upload.
* Fix CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718,
CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360,
CVE-2018-19361 and CVE-2018-19362.
Several deserialization flaws were discovered in jackson-databind which
could allow an unauthenticated user to perform code execution. The issue
was resolved by extending the blacklist and blocking more classes from
polymorphic deserialization.
- - - - -
6733e2fb by Markus Koschany at 2019-05-18T22:04:06Z
Add CVE-2019-12086.patch
- - - - -
5fe2d6ac by Markus Koschany at 2019-05-18T22:04:37Z
Update changelog
- - - - -
7 changed files:
- debian/changelog
- + debian/patches/CVE-2018-11307.patch
- + debian/patches/CVE-2018-12022.patch
- + debian/patches/CVE-2018-14718.patch
- + debian/patches/CVE-2018-19360.patch
- + debian/patches/CVE-2019-12086.patch
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,16 @@
+jackson-databind (2.8.6-1+deb9u5) stretch-security; urgency=high
+
+ * Team upload.
+ * Fix CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718,
+ CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360,
+ CVE-2018-19361, CVE-2018-19362 and CVE-2019-12086.
+ Several deserialization flaws were discovered in jackson-databind which
+ could allow an unauthenticated user to perform code execution. The issue
+ was resolved by extending the blacklist and blocking more classes from
+ polymorphic deserialization.
+
+ -- Markus Koschany <apo at debian.org> Sun, 19 May 2019 00:04:32 +0200
+
jackson-databind (2.8.6-1+deb9u4) stretch-security; urgency=high
* Team upload.
=====================================
debian/patches/CVE-2018-11307.patch
=====================================
@@ -0,0 +1,21 @@
+From: Markus Koschany <apo at debian.org>
+Date: Thu, 16 May 2019 20:53:06 +0200
+Subject: CVE-2018-11307
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2032
+Origin: https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb737
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -79,6 +79,8 @@ public class BeanDeserializerFactory
+ // [databind#1899]: more 3rd party
+ s.add("org.hibernate.jmx.StatisticsService");
+ s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
++ // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities
++ s.add("org.apache.ibatis.parsing.XPathParser");
+
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
=====================================
debian/patches/CVE-2018-12022.patch
=====================================
@@ -0,0 +1,27 @@
+From: Markus Koschany <apo at debian.org>
+Date: Thu, 16 May 2019 20:52:36 +0200
+Subject: CVE-2018-12022
+
+This is also the fix for CVE-2018-12023.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2052
+Origin: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -82,6 +82,12 @@ public class BeanDeserializerFactory
+ // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities
+ s.add("org.apache.ibatis.parsing.XPathParser");
+
++ // [databind#2052]: ldap approaches; in all cases LDAP connection String is passed
++ // and access attempt is made:
++ s.add("oracle.jdbc.connector.OracleManagedConnectionFactory");
++ s.add("jodd.db.connection.DataSourceConnectionProvider");
++ s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/CVE-2018-14718.patch
=====================================
@@ -0,0 +1,27 @@
+From: Markus Koschany <apo at debian.org>
+Date: Thu, 16 May 2019 20:50:50 +0200
+Subject: CVE-2018-14718
+
+This is also the fix for CVE-2018-14719, CVE-2018-14720, CVE-2018-14721.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2097
+Origin: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -88,6 +88,12 @@ public class BeanDeserializerFactory
+ s.add("jodd.db.connection.DataSourceConnectionProvider");
+ s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
+
++ // [databind#2097]: some 3rd party, one JDK-bundled
++ s.add("org.slf4j.ext.EventData");
++ s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
++ s.add("com.sun.deploy.security.ruleset.DRSHelper");
++ s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/CVE-2018-19360.patch
=====================================
@@ -0,0 +1,27 @@
+From: Markus Koschany <apo at debian.org>
+Date: Thu, 16 May 2019 20:41:44 +0200
+Subject: CVE-2018-19360
+
+This is also the fix for CVE-2018-19361 and CVE-2018-19362.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
+Origin: https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -94,6 +94,12 @@ public class BeanDeserializerFactory
+ s.add("com.sun.deploy.security.ruleset.DRSHelper");
+ s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
++ // [databind#2186]: yet more 3rd party gadgets
++ s.add("org.jboss.util.propertyeditor.DocumentEditor");
++ s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
++ s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
++ s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/CVE-2019-12086.patch
=====================================
@@ -0,0 +1,25 @@
+From: Markus Koschany <apo at debian.org>
+Date: Sun, 19 May 2019 00:02:45 +0200
+Subject: CVE-2019-12086
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929177
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2326
+Origin: https://github.com/FasterXML/jackson-databind/commit/dda513bd7251b4f32b7b60b1c13740e3b5a43024
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 866f9cf..c22653a 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -100,6 +100,9 @@ public class BeanDeserializerFactory
+ s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
+ s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
+
++ // [databind#2326] (2.9.9): one more 3rd party gadget
++ s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
=====================================
debian/patches/series
=====================================
@@ -5,3 +5,8 @@ CVE-2017-15095_3.patch
CVE-2018-5968.patch
CVE-2017-17485.patch
CVE-2018-7489.patch
+CVE-2018-11307.patch
+CVE-2018-12022.patch
+CVE-2018-14718.patch
+CVE-2018-19360.patch
+CVE-2019-12086.patch
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/a3a6b050addc24e6e8b6a8f5cbc692ae439503c5...5fe2d6ac3f1c8a078f78e59657942797fff45b23
--
View it on GitLab: https://salsa.debian.org/java-team/jackson-databind/compare/a3a6b050addc24e6e8b6a8f5cbc692ae439503c5...5fe2d6ac3f1c8a078f78e59657942797fff45b23
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20190523/4eb1e32c/attachment.html>
More information about the pkg-java-commits
mailing list