Skip to content

Commit 74aba40

Browse files
millemsmillems
authored
Backport all CVE fixes up to 2.9.10.6 (#2864)
1 parent 1f06b42 commit 74aba40

File tree

2 files changed

+145
-27
lines changed

2 files changed

+145
-27
lines changed

‎release-notes/VERSION

+54-22
Original file line numberDiff line numberDiff line change
@@ -4,28 +4,60 @@ Project: jackson-databind
44
=== Releases ===
55
------------------------------------------------------------------------
66

7-
2.6.8.3 (16-Nov-2019)
8-
9-
Backport of full set of CVEs as of 2.9.10, including now
10-
11-
#1680
12-
#1855
13-
#1899
14-
#2032
15-
#2052
16-
#2058
17-
#2097
18-
#2186
19-
#2326
20-
#2334
21-
#2341
22-
#2487
23-
#2389
24-
#2410
25-
#2449
26-
#2462
27-
#2478
28-
#2498
7+
2.6.7.4 (not yet released)
8+
9+
Backported all CVE fixes up to 2.9.10.6
10+
11+
#2469: Block one more gadget type (xalan2)
12+
#2526: Block two more gadget types (ehcache/JNDI - CVE-2019-20330)
13+
#2620: Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)
14+
#2631: Block one more gadget type (shaded-hikari-config, CVE-2020-9546)
15+
#2634: Block two more gadget types (ibatis-sqlmap, anteros-core; CVE-2020-9547 / CVE-2020-9548)
16+
#2642: Block one more gadget type (javax.swing, CVE-2020-10969)
17+
#2648: Block one more gadget type (shiro-core)
18+
#2653: Block one more gadget type (shiro-core, 2nd class)
19+
#2658: Block one more gadget type (ignite-jta, CVE-2020-10650)
20+
#2659: Block one more gadget type (aries.transaction.jms, CVE-2020-10672)
21+
#2660: Block one more gadget type (caucho-quercus, CVE-2020-10673)
22+
#2662: Block one more gadget type (bus-proxy, CVE-2020-10968)
23+
#2664: Block one more gadget type (activemq-pool[-jms], CVE-2020-11111)
24+
#2666: Block one more gadget type (apache/commons-proxy, CVE-2020-11112)
25+
#2670: Block one more gadget type (openjpa, CVE-2020-11113)
26+
#2680: Block one more gadget type (SSRF, spring-jpa, CVE-2020-11619)
27+
#2682: Block one more gadget type (commons-jelly, CVE-2020-11620)
28+
#2688: Block one more gadget type (apache-drill, CVE-2020-14060)
29+
#2698: Block one more gadget type (weblogic/oracle-aqjms, CVE-2020-14061)
30+
#2704: Block one more gadget type (jaxp-ri, CVE-2020-14062)
31+
#2765: Block one more gadget type (org.jsecurity, CVE-2020-14195)
32+
#2798: Block one more gadget type (com.pastdev.httpcomponents, CVE-2020-24750)
33+
#2814: Block one more gadget type (Anteros-DBCP, CVE-2020-24616)
34+
#2826: Block one more gadget type (com.nqadmin.rowset, no CVE allocated yet)
35+
#2827: Block one more gadget type (org.arrahtec:profiler-core, no CVE allocated yet)
36+
37+
2.6.7.3 (16-Oct-2019)
38+
39+
Backported all CVE fixes up to 2.9.10
40+
41+
#1680: Block more JDK gadget types (com.sun.rowset)
42+
#1855: Block more serialization gadgets (dbcp/tomcat, spring / CVE-2017-17485]
43+
#1899: Another two gadgets to exploit default typing issue in jackson-databind (CVE-2018-5968)
44+
#2032: Block one more gadget type (mybatis, CVE-2018-11307)
45+
#2052: Block one more gadget type (jodd-db, CVE-2018-12022)
46+
#2058: Block one more gadget type (oracle-jdbc, CVE-2018-12023)
47+
#2097: Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)
48+
#2186: Block more classes from polymorphic deserialization (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362)
49+
#2326: Block one more gadget type (mysql, CVE-2019-12086)
50+
#2334: Block one more gadget type (logback, CVE-2019-12384)
51+
#2341: Block yet another gadget type (jdom, CVE-2019-12814)
52+
#2387: Block one more gadget type (ehcache, CVE-2019-14379)
53+
#2389: Block one more gadget type (logback, CVE-2019-14439)
54+
#2410: Block one more gadget type (HikariCP, CVE-2019-14540)
55+
#2420: Block one more gadget type (cxf-jax-rs, no CVE allocated yet)
56+
#2449: Block one more gadget type (HikariCP, CVE-2019-14439 / CVE-2019-16335)
57+
#2462: Block two more gadget types (commons-configuration/-2)
58+
#2478: Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 / CVE-2019-16943)
59+
#2498: Block one more gadget type (apache-log4j-extras/1.2, CVE-2019-17531)
60+
2961

3062
2.6.7.2 (13-Nov-2018)
3163

‎src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java

+91-5
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,14 @@ public class BeanDeserializerFactory
6565
s.add("java.util.logging.FileHandler");
6666
s.add("java.rmi.server.UnicastRemoteObject");
6767
// [databind#1737]; 3rd party
68-
s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
68+
//s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // deprecated by [databind#1855]
6969
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
70-
s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
71-
s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
70+
// [databind#2680]
71+
s.add("org.springframework.aop.config.MethodLocatingFactoryBean");
72+
s.add("org.springframework.beans.factory.config.BeanReferenceFactoryBean");
7273

74+
// s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); // deprecated by [databind#1931]
75+
// s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); // - "" -
7376
// [databind#1855]: more 3rd party
7477
s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
7578
s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
@@ -92,10 +95,11 @@ public class BeanDeserializerFactory
9295
s.add("com.sun.deploy.security.ruleset.DRSHelper");
9396
s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
9497

95-
// [databind#2186]: yet more 3rd party gadgets
98+
// [databind#2186], [databind#2670]: yet more 3rd party gadgets
9699
s.add("org.jboss.util.propertyeditor.DocumentEditor");
97100
s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
98101
s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
102+
s.add("org.apache.openjpa.ee.WASRegistryManagedRuntime"); // [#2670] addition
99103
s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
100104

101105
// [databind#2326]
@@ -127,8 +131,10 @@ public class BeanDeserializerFactory
127131
s.add("org.apache.commons.configuration.JNDIConfiguration");
128132
s.add("org.apache.commons.configuration2.JNDIConfiguration");
129133

130-
// [databind#2469]: xalan2
134+
// [databind#2469]: xalan
131135
s.add("org.apache.xalan.lib.sql.JNDIConnectionPool");
136+
// [databind#2704]: xalan2
137+
s.add("com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool");
132138

133139
// [databind#2478]: comons-dbcp, p6spy
134140
s.add("org.apache.commons.dbcp.datasources.PerUserPoolDataSource");
@@ -139,6 +145,86 @@ public class BeanDeserializerFactory
139145
s.add("org.apache.log4j.receivers.db.DriverManagerConnectionSource");
140146
s.add("org.apache.log4j.receivers.db.JNDIConnectionSource");
141147

148+
// [databind#2526]: some more ehcache
149+
s.add("net.sf.ehcache.transaction.manager.selector.GenericJndiSelector");
150+
s.add("net.sf.ehcache.transaction.manager.selector.GlassfishSelector");
151+
152+
// [databind#2620]: xbean-reflect
153+
s.add("org.apache.xbean.propertyeditor.JndiConverter");
154+
155+
// [databind#2631]: shaded hikari-config
156+
s.add("org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig");
157+
158+
// [databind#2634]: ibatis-sqlmap, anteros-core/-dbcp
159+
s.add("com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig");
160+
s.add("br.com.anteros.dbcp.AnterosDBCPConfig");
161+
// [databind#2814]: anteros-dbcp
162+
s.add("br.com.anteros.dbcp.AnterosDBCPDataSource");
163+
164+
// [databind#2642][databind#2854]: javax.swing (jdk)
165+
s.add("javax.swing.JEditorPane");
166+
s.add("javax.swing.JTextPane");
167+
168+
// [databind#2648], [databind#2653]: shiro-core
169+
s.add("org.apache.shiro.realm.jndi.JndiRealmFactory");
170+
s.add("org.apache.shiro.jndi.JndiObjectFactory");
171+
172+
// [databind#2658]: ignite-jta (, quartz-core)
173+
s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
174+
s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
175+
s.add("org.quartz.utils.JNDIConnectionProvider");
176+
177+
// [databind#2659]: aries.transaction.jms
178+
s.add("org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory");
179+
s.add("org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory");
180+
181+
// [databind#2660]: caucho-quercus
182+
s.add("com.caucho.config.types.ResourceRef");
183+
184+
// [databind#2662]: aoju/bus-proxy
185+
s.add("org.aoju.bus.proxy.provider.RmiProvider");
186+
s.add("org.aoju.bus.proxy.provider.remoting.RmiProvider");
187+
188+
// [databind#2664]: activemq-core, activemq-pool, activemq-pool-jms
189+
190+
s.add("org.apache.activemq.ActiveMQConnectionFactory"); // core
191+
s.add("org.apache.activemq.ActiveMQXAConnectionFactory");
192+
s.add("org.apache.activemq.spring.ActiveMQConnectionFactory");
193+
s.add("org.apache.activemq.spring.ActiveMQXAConnectionFactory");
194+
s.add("org.apache.activemq.pool.JcaPooledConnectionFactory"); // pool
195+
s.add("org.apache.activemq.pool.PooledConnectionFactory");
196+
s.add("org.apache.activemq.pool.XaPooledConnectionFactory");
197+
s.add("org.apache.activemq.jms.pool.XaPooledConnectionFactory"); // pool-jms
198+
s.add("org.apache.activemq.jms.pool.JcaPooledConnectionFactory");
199+
200+
// [databind#2666]: apache/commons-jms
201+
s.add("org.apache.commons.proxy.provider.remoting.RmiProvider");
202+
203+
// [databind#2682]: commons-jelly
204+
s.add("org.apache.commons.jelly.impl.Embedded");
205+
206+
// [databind#2688]: apache/drill
207+
s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool");
208+
209+
// [databind#2698]: weblogic w/ oracle/aq-jms
210+
// (note: dependency not available via Maven Central, but as part of
211+
// weblogic installation, possibly fairly old version(s))
212+
s.add("oracle.jms.AQjmsQueueConnectionFactory");
213+
s.add("oracle.jms.AQjmsXATopicConnectionFactory");
214+
s.add("oracle.jms.AQjmsTopicConnectionFactory");
215+
s.add("oracle.jms.AQjmsXAQueueConnectionFactory");
216+
s.add("oracle.jms.AQjmsXAConnectionFactory");
217+
218+
// [databind#2765]: org.jsecurity:
219+
s.add("org.jsecurity.realm.jndi.JndiRealmFactory");
220+
221+
// [databind#2798]: com.pastdev.httpcomponents:
222+
s.add("com.pastdev.httpcomponents.configuration.JndiConfiguration");
223+
224+
// [databind#2826], [databind#2827]
225+
s.add("com.nqadmin.rowset.JdbcRowSetImpl");
226+
s.add("org.arrah.framework.rdbms.UpdatableJdbcRowsetImpl");
227+
142228
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
143229
}
144230

0 commit comments

Comments
 (0)