[
https://issues.apache.org/jira/browse/CASSANDRA-21717?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18119175#comment-18119175
]
Kapil Shewate commented on CASSANDRA-21717:
-------------------------------------------
CVEID: CVE-2026-54513
Description: jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.10.0 until
2.18.8, 2.21.4, and 3.1.4,
BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any
array type based only on clazz.isArray(), without validating the array's
component (element) type against the configured allowlist. A PTV built with
allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore
still permits EvilType[] even though EvilType is not allowlisted. When Jackson
deserializes the elements and no per-element type IDs are present, it
instantiates the component type directly with no further PTV check, bypassing
the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
CWE: CWE-184: Incomplete List of Disallowed Inputs
CVSS Source: [email protected]
CVSS Base Score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-54514
Description: jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.0.0 until
2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed
InetSocketAddress with new InetSocketAddress(host, port), which performs eager
DNS name resolution for hostname inputs at deserialization time. An application
that binds untrusted JSON into a type containing an InetSocketAddress field
issues an attacker-chosen DNS query during readValue, before any
application-level validation or connect logic. The fix uses
InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit
connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
CWE: CWE-918: Server-Side Request Forgery (SSRF)
CVSS Source: [email protected]
CVSS Base Score: 5.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2026-54515
Description: jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.8.0 until
2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(),
per-property @JsonIgnoreProperties exclusions are applied by
_handleByNameInclusion(), producing a contextual deserializer whose
BeanPropertyMap has the ignored properties removed. The subsequent per-property
case-insensitivity block (triggered by
@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from
this._beanProperties (the original, unfiltered map) instead of
contextual._beanProperties, then overwrites the filtered map — restoring every
property _handleByNameInclusion had just removed. The ignored property becomes
writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined
Object Attributes
CVSS Source: [email protected]
CVSS Base Score: 5.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2026-59888
Description: jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. From 2.15.0 until
2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can
bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals()
records an ignored component under its original implicit name before
_renameUsing() applies the naming strategy, allowing the renamed JSON key to be
assigned to the Record constructor parameter. This issue is fixed in versions
2.18.8, 2.21.4, and 3.1.4.
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined
Object Attributes
CVSS Source: [email protected]
CVSS Base Score: 6.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVEID: CVE-2026-77310
Description: jackson-databind contains the general-purpose data-binding
functionality and tree-model for Jackson Data Processor. Prior to versions
2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the
java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls
InetAddress.getByName() on attacker-controlled input, causing eager DNS
resolution during deserialization and enabling DNS-based server-side request
forgery and internal-host enumeration. This issue is fixed in versions 2.18.9,
2.21.5, 2.22.1, 3.1.5, and 3.2.1.
CWE: CWE-918: Server-Side Request Forgery (SSRF)
CVSS Source: [email protected]
CVSS Base Score: 5.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
> CVE-2026-54512.jackson-databind contains the general-purpose data-binding
> functionality and tree-model for Jackson Data Processor.
> ----------------------------------------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-21717
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21717
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Kapil Shewate
> Priority: Normal
>
> CVEID: CVE-2026-54512
> Description: jackson-databind contains the general-purpose data-binding
> functionality and tree-model for Jackson Data Processor. From 2.10.0 until
> 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV)
> is the primary safety mechanism guarding polymorphic deserialization. When
> polymorphic typing is enabled and a type identifier contains generic
> parameters (i.e. the type ID string contains <),
> DatabindContext._resolveAndValidateGeneric() validates only the raw container
> class name (the substring before <) against the configured PTV. If the
> container type is approved, the method parses the full canonical type string
> via TypeFactory.constructFromCanonical() and returns the fully parameterized
> type without ever validating the nested type arguments against the PTV. The
> nested type arguments are then resolved, instantiated, and populated as beans
> during deserialization. An attacker who controls the type ID can therefore
> place a denied class as a generic type parameter of an allowed container —
> for example java.util.ArrayList<com.evil.Gadget> when only
> java.util.ArrayList is allow-listed. The container passes the PTV check;
> com.evil.Gadget is loaded via Class.forName(name, true, loader),
> instantiated, and its properties are set from attacker-controlled JSON. This
> completely bypasses an explicitly configured PTV allow-list. This
> vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
> CWE: CWE-184: Incomplete List of Disallowed Inputs
> CVSS Source: [email protected]
> CVSS Base Score: 8.1
> CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
