From 98135e27ed58e980c3dd7614c04fb37b828f21c7 Mon Sep 17 00:00:00 2001 From: Mat Booth Date: Fri, 3 Nov 2017 13:59:04 +0000 Subject: [PATCH] Backport a patch to fix CVE-2017-15095 --- CVE-2017-15095.patch | 33 +++++++++++++++++++++++++++++++++ jackson-databind.spec | 7 ++++++- 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 CVE-2017-15095.patch diff --git a/CVE-2017-15095.patch b/CVE-2017-15095.patch new file mode 100644 index 0000000..1f06b1c --- /dev/null +++ b/CVE-2017-15095.patch @@ -0,0 +1,33 @@ +--- src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java.orig 2017-11-01 09:57:37.083991374 +0000 ++++ src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java 2017-11-01 10:00:58.032279501 +0000 +@@ -48,16 +48,29 @@ + static { + Set s = new HashSet(); + // Courtesy of [https://github.com/kantega/notsoserial]: +- // (and wrt [databind#1599] ++ // (and wrt [databind#1599]) + s.add("org.apache.commons.collections.functors.InvokerTransformer"); + s.add("org.apache.commons.collections.functors.InstantiateTransformer"); + s.add("org.apache.commons.collections4.functors.InvokerTransformer"); + s.add("org.apache.commons.collections4.functors.InstantiateTransformer"); ++ // 05-Aug-2017, tatu: as per [https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf] ++ // this is NOT likely to be exploitable via Jackson. But keep excluded just in case. + s.add("org.codehaus.groovy.runtime.ConvertedClosure"); + s.add("org.codehaus.groovy.runtime.MethodClosure"); + s.add("org.springframework.beans.factory.ObjectFactory"); + s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); + s.add("org.apache.xalan.xsltc.trax.TemplatesImpl"); ++ // [databind#1680]: may or may not be problem, take no chance ++ s.add("com.sun.rowset.JdbcRowSetImpl"); ++ // [databind#1737]; JDK provided ++ s.add("java.util.logging.FileHandler"); ++ s.add("java.rmi.server.UnicastRemoteObject"); ++ // [databind#1737]; 3rd party ++ s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); ++ s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean"); ++ s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); ++ s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); ++ + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); + } + diff --git a/jackson-databind.spec b/jackson-databind.spec index 140d9fa..06096a4 100644 --- a/jackson-databind.spec +++ b/jackson-databind.spec @@ -1,12 +1,13 @@ Name: jackson-databind Version: 2.7.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: General data-binding package for Jackson (2.x) License: ASL 2.0 and LGPLv2+ URL: http://wiki.fasterxml.com/JacksonHome Source0: https://github.com/FasterXML/jackson-databind/archive/%{name}-%{version}.tar.gz Patch0: CVE-2017-7525.patch +Patch1: CVE-2017-15095.patch BuildRequires: maven-local BuildRequires: mvn(com.fasterxml.jackson:jackson-parent:pom:) @@ -32,6 +33,7 @@ This package contains javadoc for %{name}. %prep %setup -q -n %{name}-%{name}-%{version} %patch0 -p1 +%patch1 cp -p src/main/resources/META-INF/LICENSE . cp -p src/main/resources/META-INF/NOTICE . @@ -70,6 +72,9 @@ rm src/test/java/com/fasterxml/jackson/databind/ser/TestJdkTypes.java \ %license LICENSE NOTICE %changelog +* Fri Nov 03 2017 Mat Booth - 2.7.6-5 +- Backport a patch to fix CVE-2017-15095 + * Wed Jul 26 2017 Fedora Release Engineering - 2.7.6-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild