--- Begin Message ---
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
Dear release team,
Please unblock package jackson-databind
It would be great if we could include the latest security fixes for
this package. #930750
Thanks,
Markus
unblock jackson-databind/2.9.8-3
-- System Information:
Debian Release: 10.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-9-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect
diff -Nru jackson-databind-2.9.8/debian/changelog jackson-databind-2.9.8/debian/changelog
--- jackson-databind-2.9.8/debian/changelog 2019-05-18 20:31:28.000000000 +0200
+++ jackson-databind-2.9.8/debian/changelog 2019-06-22 00:28:48.000000000 +0200
@@ -1,3 +1,16 @@
+jackson-databind (2.9.8-3) unstable; urgency=medium
+
+ * Team upload.
+ * Fix CVE-2019-12814 and CVE-2019-12384:
+ More Polymorphic Typing issues were discovered in jackson-databind. When
+ Default Typing is enabled (either globally or for a specific property) for
+ an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x or
+ logback-core jar in the classpath, an attacker can send a specifically
+ crafted JSON message that allows them to read arbitrary local files on the
+ server. (Closes: #930750)
+
+ -- Markus Koschany <apo@debian.org> Sat, 22 Jun 2019 00:28:48 +0200
+
jackson-databind (2.9.8-2) unstable; urgency=medium
* Team upload.
diff -Nru jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch
--- jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch 1970-01-01 01:00:00.000000000 +0100
+++ jackson-databind-2.9.8/debian/patches/CVE-2019-12384.patch 2019-06-22 00:28:48.000000000 +0200
@@ -0,0 +1,24 @@
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 22 Jun 2019 00:00:02 +0200
+Subject: CVE-2019-12384
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750
+Origin: https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234
+---
+ .../com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+index a17cdf5..3dbb16e 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+@@ -83,6 +83,9 @@ public class SubTypeValidator
+ // [databind#2326] (2.9.9): one more 3rd party gadget
+ s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+
++ // [databind#2334] (2.9.9.1): logback-core
++ s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
diff -Nru jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch
--- jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch 1970-01-01 01:00:00.000000000 +0100
+++ jackson-databind-2.9.8/debian/patches/CVE-2019-12814.patch 2019-06-22 00:28:48.000000000 +0200
@@ -0,0 +1,29 @@
+From: Markus Koschany <apo@debian.org>
+Date: Sat, 22 Jun 2019 00:26:32 +0200
+Subject: CVE-2019-12814
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930750
+Origin: https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5
+---
+ .../fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+index 3dbb16e..72db61d 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+@@ -83,9 +83,13 @@ public class SubTypeValidator
+ // [databind#2326] (2.9.9): one more 3rd party gadget
+ s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
+
+- // [databind#2334] (2.9.9.1): logback-core
++ // [databind#2334]: logback-core
+ s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
+
++ // [databind#2341]: jdom/jdom2
++ s.add("org.jdom.transform.XSLTransformer");
++ s.add("org.jdom2.transform.XSLTransformer");
++
+ DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+ }
+
diff -Nru jackson-databind-2.9.8/debian/patches/series jackson-databind-2.9.8/debian/patches/series
--- jackson-databind-2.9.8/debian/patches/series 2019-05-18 20:31:28.000000000 +0200
+++ jackson-databind-2.9.8/debian/patches/series 2019-06-22 00:28:48.000000000 +0200
@@ -1 +1,3 @@
CVE-2019-12086.patch
+CVE-2019-12384.patch
+CVE-2019-12814.patch
--- End Message ---