Package: release.debian.org Severity: normal User: release.debian....@packages.debian.org Usertags: unblock
Dear release team, Please unblock package jackson-databind It would be great if we could include the latest security fixes for this package. #930750 Thanks, Markus unblock jackson-databind/2.9.8-3 -- System Information: Debian Release: 10.0 APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-9-amd64 (SMP w/4 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: unable to detect
diff -Nru jackson-databind-2.9.8/debian/changelog jackson-databind-2.9.8/debian/changelog --- jackson-databind-2.9.8/debian/changelog 2019-05-18 20:31:28.000000000 +0200 +++ jackson-databind-2.9.8/debian/changelog 2019-06-22 00:28:48.000000000 +0200 @@ -1,3 +1,16 @@ +jackson-databind (2.9.8-3) unstable; urgency=medium + + * Team upload. + * Fix CVE-2019-12814 and CVE-2019-12384: + More Polymorphic Typing issues were discovered in jackson-databind. When + Default Typing is enabled (either globally or for a specific property) for + an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x or + logback-core jar in the classpath, an attacker can send a specifically + crafted JSON message that allows them to read arbitrary local files on the + server. (Closes: #930750) + + -- Markus Koschany <a...@debian.org> Sat, 22 Jun 2019 00:28:48 +0200 + jackson-databind (2.9.8-2) unstable; urgency=medium * Team upload. diff -Nru jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch --- jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch 1970-01-01 01:00:00.000000000 +0100 +++ jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch 2019-06-22 00:28:48.000000000 +0200 @@ -0,0 +1,24 @@ +From: Markus Koschany <a...@debian.org> +Date: Sat, 22 Jun 2019 00:00:02 +0200 +Subject: CVE-2019-12384 + +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750 +Origin: https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234 +--- + .../com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +index a17cdf5..3dbb16e 100644 +--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java ++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +@@ -83,6 +83,9 @@ public class SubTypeValidator + // [databind#2326] (2.9.9): one more 3rd party gadget + s.add("com.mysql.cj.jdbc.admin.MiniAdmin"); + ++ // [databind#2334] (2.9.9.1): logback-core ++ s.add("ch.qos.logback.core.db.DriverManagerConnectionSource"); ++ + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); + } + diff -Nru jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch --- jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch 1970-01-01 01:00:00.000000000 +0100 +++ jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch 2019-06-22 00:28:48.000000000 +0200 @@ -0,0 +1,29 @@ +From: Markus Koschany <a...@debian.org> +Date: Sat, 22 Jun 2019 00:26:32 +0200 +Subject: CVE-2019-12814 + +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750 +Origin: https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5 +--- + .../fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +index 3dbb16e..72db61d 100644 +--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java ++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +@@ -83,9 +83,13 @@ public class SubTypeValidator + // [databind#2326] (2.9.9): one more 3rd party gadget + s.add("com.mysql.cj.jdbc.admin.MiniAdmin"); + +- // [databind#2334] (2.9.9.1): logback-core ++ // [databind#2334]: logback-core + s.add("ch.qos.logback.core.db.DriverManagerConnectionSource"); + ++ // [databind#2341]: jdom/jdom2 ++ s.add("org.jdom.transform.XSLTransformer"); ++ s.add("org.jdom2.transform.XSLTransformer"); ++ + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); + } + diff -Nru jackson-databind-2.9.8/debian/patches/series jackson-databind-2.9.8/debian/patches/series --- jackson-databind-2.9.8/debian/patches/series 2019-05-18 20:31:28.000000000 +0200 +++ jackson-databind-2.9.8/debian/patches/series 2019-06-22 00:28:48.000000000 +0200 @@ -1 +1,3 @@ CVE-2019-12086.patch +CVE-2019-12384.patch +CVE-2019-12814.patch