Skip to content

Commit 03f30bf

Browse files
cowtowncodercowtowncoder
committed
Merge branch '2.7' into 2.8
2 parents f9a9122 + 74bfed9 commit 03f30bf

File tree

2 files changed

+85
-13
lines changed

2 files changed

+85
-13
lines changed

‎release-notes/VERSION

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,12 @@ Project: jackson-databind
33
=== Releases ===
44
------------------------------------------------------------------------
55

6+
Since last release
7+
8+
- Bunch of CVE backports from 2.9 (via https://github.com/FasterXML/jackson-databind/pull/2858)
9+
* #2653 #2658 #2659 #2660 #2662 #2664 #2666 #2670 #2680 #2682 #2688 #2698
10+
#2704 #2765 #2798 #2814 #2826 #2827 #2854
11+
612
2.8.11.6 (10-Mar-2020)
713

814
#2631: Block one more gadget type (shaded-hikari-config, CVE-2020-9546)
@@ -15,14 +21,14 @@ Project: jackson-databind
1521

1622
2.8.11.5 (10-Feb-2020)
1723

18-
#2410: Block one more gadget type (CVE-2019-14540)
24+
#2410: Block one more gadget type (HikariCP, CVE-2019-14540)
1925
(reported by iSafeBlue@github / [email protected])
20-
#2420: Block one more gadget type (no CVE allocated yet)
26+
#2420: Block one more gadget type (cxf-jax-rs, no CVE allocated yet)
2127
(reported by [email protected])
22-
#2449: Block one more gadget type (cve CVE-2019-14540)
28+
#2449: Block one more gadget type (HikariCP, CVE-2019-14439 / CVE-2019-16335)
2329
(reported by kingkk)
2430
#2460: Block one more gadget type (ehcache, CVE-2019-17267)
25-
#2462: Block two more gadget types (commons-configuration)
31+
#2462: Block two more gadget types (commons-configuration/-2)
2632
#2469: Block one more gadget type (xalan2)
2733
#2478: Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 / CVE-2019-16943)
2834
#2498: Block one more gadget type (log4j-extras/1.2, CVE-2019-17531)

‎src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

Lines changed: 75 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ public class SubTypeValidator
4848
// [databind#1737]; 3rd party
4949
//s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // deprecated by [databind#1855]
5050
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
51+
// [databind#2680]
52+
s.add("org.springframework.aop.config.MethodLocatingFactoryBean");
53+
s.add("org.springframework.beans.factory.config.BeanReferenceFactoryBean");
5154

5255
// s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); // deprecated by [databind#1931]
5356
// s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); // - "" -
@@ -73,19 +76,20 @@ public class SubTypeValidator
7376
s.add("com.sun.deploy.security.ruleset.DRSHelper");
7477
s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
7578

76-
// [databind#2186]: yet more 3rd party gadgets
79+
// [databind#2186], [databind#2670]: yet more 3rd party gadgets
7780
s.add("org.jboss.util.propertyeditor.DocumentEditor");
7881
s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
7982
s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
83+
s.add("org.apache.openjpa.ee.WASRegistryManagedRuntime"); // [#2670] addition
8084
s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
8185

82-
// [databind#2326]
83-
s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
86+
// [databind#2326] (2.9.9)
87+
s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
8488

85-
// [databind#2334]: logback-core
89+
// [databind#2334]: logback-core (2.9.9.1)
8690
s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
8791

88-
// [databind#2341]: jdom/jdom2
92+
// [databind#2341]: jdom/jdom2 (2.9.9.1)
8993
s.add("org.jdom.transform.XSLTransformer");
9094
s.add("org.jdom2.transform.XSLTransformer");
9195

@@ -108,8 +112,10 @@ public class SubTypeValidator
108112
s.add("org.apache.commons.configuration.JNDIConfiguration");
109113
s.add("org.apache.commons.configuration2.JNDIConfiguration");
110114

111-
// [databind#2469]: xalan2
115+
// [databind#2469]: xalan
112116
s.add("org.apache.xalan.lib.sql.JNDIConnectionPool");
117+
// [databind#2704]: xalan2
118+
s.add("com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool");
113119

114120
// [databind#2478]: comons-dbcp, p6spy
115121
s.add("org.apache.commons.dbcp.datasources.PerUserPoolDataSource");
@@ -130,15 +136,75 @@ public class SubTypeValidator
130136
// [databind#2631]: shaded hikari-config
131137
s.add("org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig");
132138

133-
// [databind#2634]: ibatis-sqlmap, anteros-core
139+
// [databind#2634]: ibatis-sqlmap, anteros-core/-dbcp
134140
s.add("com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig");
135141
s.add("br.com.anteros.dbcp.AnterosDBCPConfig");
142+
// [databind#2814]: anteros-dbcp
143+
s.add("br.com.anteros.dbcp.AnterosDBCPDataSource");
136144

137-
// [databind#2642]: javax.swing (jdk)
145+
// [databind#2642][databind#2854]: javax.swing (jdk)
138146
s.add("javax.swing.JEditorPane");
147+
s.add("javax.swing.JTextPane");
139148

140-
// [databind#2648]: shire-core
149+
// [databind#2648], [databind#2653]: shire-core
141150
s.add("org.apache.shiro.realm.jndi.JndiRealmFactory");
151+
s.add("org.apache.shiro.jndi.JndiObjectFactory");
152+
153+
// [databind#2658]: ignite-jta (, quartz-core)
154+
s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
155+
s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
156+
s.add("org.quartz.utils.JNDIConnectionProvider");
157+
158+
// [databind#2659]: aries.transaction.jms
159+
s.add("org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory");
160+
s.add("org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory");
161+
162+
// [databind#2660]: caucho-quercus
163+
s.add("com.caucho.config.types.ResourceRef");
164+
165+
// [databind#2662]: aoju/bus-proxy
166+
s.add("org.aoju.bus.proxy.provider.RmiProvider");
167+
s.add("org.aoju.bus.proxy.provider.remoting.RmiProvider");
168+
169+
// [databind#2664]: activemq-core, activemq-pool, activemq-pool-jms
170+
171+
s.add("org.apache.activemq.ActiveMQConnectionFactory"); // core
172+
s.add("org.apache.activemq.ActiveMQXAConnectionFactory");
173+
s.add("org.apache.activemq.spring.ActiveMQConnectionFactory");
174+
s.add("org.apache.activemq.spring.ActiveMQXAConnectionFactory");
175+
s.add("org.apache.activemq.pool.JcaPooledConnectionFactory"); // pool
176+
s.add("org.apache.activemq.pool.PooledConnectionFactory");
177+
s.add("org.apache.activemq.pool.XaPooledConnectionFactory");
178+
s.add("org.apache.activemq.jms.pool.XaPooledConnectionFactory"); // pool-jms
179+
s.add("org.apache.activemq.jms.pool.JcaPooledConnectionFactory");
180+
181+
// [databind#2666]: apache/commons-jms
182+
s.add("org.apache.commons.proxy.provider.remoting.RmiProvider");
183+
184+
// [databind#2682]: commons-jelly
185+
s.add("org.apache.commons.jelly.impl.Embedded");
186+
187+
// [databind#2688]: apache/drill
188+
s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool");
189+
190+
// [databind#2698]: weblogic w/ oracle/aq-jms
191+
// (note: dependency not available via Maven Central, but as part of
192+
// weblogic installation, possibly fairly old version(s))
193+
s.add("oracle.jms.AQjmsQueueConnectionFactory");
194+
s.add("oracle.jms.AQjmsXATopicConnectionFactory");
195+
s.add("oracle.jms.AQjmsTopicConnectionFactory");
196+
s.add("oracle.jms.AQjmsXAQueueConnectionFactory");
197+
s.add("oracle.jms.AQjmsXAConnectionFactory");
198+
199+
// [databind#2764]: org.jsecurity:
200+
s.add("org.jsecurity.realm.jndi.JndiRealmFactory");
201+
202+
// [databind#2798]: com.pastdev.httpcomponents:
203+
s.add("com.pastdev.httpcomponents.configuration.JndiConfiguration");
204+
205+
// [databind#2826], [databind#2827]
206+
s.add("com.nqadmin.rowset.JdbcRowSetImpl");
207+
s.add("org.arrah.framework.rdbms.UpdatableJdbcRowsetImpl");
142208

143209
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
144210
}

0 commit comments

Comments
 (0)