rpms/jackson-databind
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport a patch to fix CVE-2017-15095

Browse Source
This commit is contained in:
Mat Booth 2017-11-03 13:59:04 +00:00
parent b7db8ae320
commit 98135e27ed
2 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
CVE-2017-15095.patch Normal file
View File

@ -0,0 +1,33 @@
--- src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java.orig 2017-11-01 09:57:37.083991374 +0000
+++ src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java 2017-11-01 10:00:58.032279501 +0000
@@ -48,16 +48,29 @@
static {
Set<String> s = new HashSet<String>();
// Courtesy of [https://github.com/kantega/notsoserial]:
- // (and wrt [databind#1599]
+ // (and wrt [databind#1599])
s.add("org.apache.commons.collections.functors.InvokerTransformer");
s.add("org.apache.commons.collections.functors.InstantiateTransformer");
s.add("org.apache.commons.collections4.functors.InvokerTransformer");
s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
+ // 05-Aug-2017, tatu: as per [https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf]
+ // this is NOT likely to be exploitable via Jackson. But keep excluded just in case.
s.add("org.codehaus.groovy.runtime.ConvertedClosure");
s.add("org.codehaus.groovy.runtime.MethodClosure");
s.add("org.springframework.beans.factory.ObjectFactory");
s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
+ // [databind#1680]: may or may not be problem, take no chance
+ s.add("com.sun.rowset.JdbcRowSetImpl");
+ // [databind#1737]; JDK provided
+ s.add("java.util.logging.FileHandler");
+ s.add("java.rmi.server.UnicastRemoteObject");
+ // [databind#1737]; 3rd party
+ s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
+ s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
+ s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
+ s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
+
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
}

7
jackson-databind.spec
View File

@ -1,12 +1,13 @@
Name: jackson-databind
Version: 2.7.6
Release: 4%{?dist}
Release: 5%{?dist}
Summary: General data-binding package for Jackson (2.x)
License: ASL 2.0 and LGPLv2+
URL: http://wiki.fasterxml.com/JacksonHome
Source0: https://github.com/FasterXML/jackson-databind/archive/%{name}-%{version}.tar.gz
Patch0: CVE-2017-7525.patch
Patch1: CVE-2017-15095.patch
BuildRequires: maven-local
BuildRequires: mvn(com.fasterxml.jackson:jackson-parent:pom:)
@ -32,6 +33,7 @@ This package contains javadoc for %{name}.
%prep
%setup -q -n %{name}-%{name}-%{version}
%patch0 -p1
%patch1
cp -p src/main/resources/META-INF/LICENSE .
cp -p src/main/resources/META-INF/NOTICE .
@ -70,6 +72,9 @@ rm src/test/java/com/fasterxml/jackson/databind/ser/TestJdkTypes.java \
%license LICENSE NOTICE
%changelog
* Fri Nov 03 2017 Mat Booth <mat.booth@redhat.com> - 2.7.6-5
- Backport a patch to fix CVE-2017-15095
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.6-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild