Bug#888318: jackson-databind: CVE-2017-17485

[Salvatore Bonaccorso]

Source: jackson-databind
Version: 2.9.1-1
Severity: grave
Tags: security upstream
Forwarded: https://github.com/FasterXML/jackson-databind/issues/1855

Hi,

the following vulnerability was published for jackson-databind.

CVE-2017-17485[0]:
| FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3
| allows unauthenticated remote code execution because of an incomplete
| fix for the CVE-2017-7525 deserialization flaw. This is exploitable by
| sending maliciously crafted JSON input to the readValue method of the
| ObjectMapper, bypassing a blacklist that is ineffective if the Spring
| libraries are available in the classpath.

Please note in the security-tracker we initially marked this issue as
not-affected, since Red Hat claimed in [2] that it was a incomplete
fix specific to some Red Hat packages.
Could you double-check this and in case this bug was wronly open
report back? But it looks that the corresponding changes would as well
be missing from the Debian package.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17485
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17485
[1] https://github.com/FasterXML/jackson-databind/issues/1855
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1528565#c0

Please adjust the affected versions in the BTS as needed, in
particular no check for stable and oldstable has been done yet.

Regards,
Salvatore

__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use
debian-***@lists.debian.org for discussions and questions.

[Salvatore Bonaccorso]

Post by Salvatore Bonaccorso
Source: jackson-databind
Version: 2.9.1-1
Severity: grave
Tags: security upstream
Forwarded: https://github.com/FasterXML/jackson-databind/issues/1855
Hi,
the following vulnerability was published for jackson-databind.
| FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3
| allows unauthenticated remote code execution because of an incomplete
| fix for the CVE-2017-7525 deserialization flaw. This is exploitable by
| sending maliciously crafted JSON input to the readValue method of the
| ObjectMapper, bypassing a blacklist that is ineffective if the Spring
| libraries are available in the classpath.
Please note in the security-tracker we initially marked this issue as
not-affected, since Red Hat claimed in [2] that it was a incomplete
fix specific to some Red Hat packages.
Could you double-check this and in case this bug was wronly open
report back? But it looks that the corresponding changes would as well
be missing from the Debian package.

From a quick skimm over the applied patches in stable I would say we
missed those as well.

Regards,
Salvatore

__
This is the maintainer address of Debian's Java team
<http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use
debian-***@lists.debian.org for discussions and questions.

[Debian Bug Tracking System]

Your message dated Thu, 25 Jan 2018 23:19:37 +0000
with message-id <E1eeqnx-000Bro-***@fasolo.debian.org>
and subject line Bug#888318: fixed in jackson-databind 2.9.4-1
has caused the Debian Bug report #888318,
regarding jackson-databind: CVE-2017-17485
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)