From a3939d36edcc755c8af55bdc1969e0fa8438f9db Mon Sep 17 00:00:00 2001 From: Tatu Saloranta Date: Tue, 15 Oct 2019 21:10:57 -0700 Subject: [PATCH] Backport 19 CVE fixes all the way to 2.9.10 --- release-notes/VERSION | 23 +++++++ .../deser/BeanDeserializerFactory.java | 67 ++++++++++++++++++- 2 files changed, 89 insertions(+), 1 deletion(-) diff --git a/release-notes/VERSION b/release-notes/VERSION index 0b017e2116..561a45f31f 100644 --- a/release-notes/VERSION +++ b/release-notes/VERSION @@ -4,6 +4,29 @@ Project: jackson-databind === Releases === ------------------------------------------------------------------------ +2.6.8.3 (16-Nov-2019) + +Backport of full set of CVEs as of 2.9.10, including now + +#1680 +#1855 +#1899 +#2032 +#2052 +#2058 +#2097 +#2186 +#2326 +#2334 +#2341 +#2487 +#2389 +#2410 +#2449 +#2462 +#2478 +#2498 + 2.6.7.2 (13-Nov-2018) #1737: Block more JDK types from polymorphic deserialization diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java index fb4c904b7c..8b66bee280 100644 --- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java +++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java @@ -58,7 +58,9 @@ public class BeanDeserializerFactory s.add("org.codehaus.groovy.runtime.MethodClosure"); s.add("org.springframework.beans.factory.ObjectFactory"); s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"); - + s.add("org.apache.xalan.xsltc.trax.TemplatesImpl"); + // [databind#1680]: may or may not be problem, take no chance + s.add("com.sun.rowset.JdbcRowSetImpl"); // [databind#1737]; JDK provided s.add("java.util.logging.FileHandler"); s.add("java.rmi.server.UnicastRemoteObject"); @@ -68,12 +70,75 @@ public class BeanDeserializerFactory s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); + // [databind#1855]: more 3rd party + s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource"); + s.add("com.sun.org.apache.bcel.internal.util.ClassLoader"); + // [databind#1899]: more 3rd party + s.add("org.hibernate.jmx.StatisticsService"); + s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory"); + // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities + s.add("org.apache.ibatis.parsing.XPathParser"); + + // [databind#2052]: Jodd-db, with jndi/ldap lookup + s.add("jodd.db.connection.DataSourceConnectionProvider"); + + // [databind#2058]: Oracle JDBC driver, with jndi/ldap lookup + s.add("oracle.jdbc.connector.OracleManagedConnectionFactory"); + s.add("oracle.jdbc.rowset.OracleJDBCRowSet"); + // [databind#2097]: some 3rd party, one JDK-bundled s.add("org.slf4j.ext.EventData"); s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor"); s.add("com.sun.deploy.security.ruleset.DRSHelper"); s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl"); + // [databind#2186]: yet more 3rd party gadgets + s.add("org.jboss.util.propertyeditor.DocumentEditor"); + s.add("org.apache.openjpa.ee.RegistryManagedRuntime"); + s.add("org.apache.openjpa.ee.JNDIManagedRuntime"); + s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo"); + + // [databind#2326] + s.add("com.mysql.cj.jdbc.admin.MiniAdmin"); + + // [databind#2334]: logback-core + s.add("ch.qos.logback.core.db.DriverManagerConnectionSource"); + + // [databind#2341]: jdom/jdom2 + s.add("org.jdom.transform.XSLTransformer"); + s.add("org.jdom2.transform.XSLTransformer"); + + // [databind#2387], [databind#2460]: EHCache + s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup"); + s.add("net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup"); + + // [databind#2389]: logback/jndi + s.add("ch.qos.logback.core.db.JNDIConnectionSource"); + + // [databind#2410]: HikariCP/metricRegistry config + s.add("com.zaxxer.hikari.HikariConfig"); + // [databind#2449]: and sub-class thereof + s.add("com.zaxxer.hikari.HikariDataSource"); + + // [databind#2420]: CXF/JAX-RS provider/XSLT + s.add("org.apache.cxf.jaxrs.provider.XSLTJaxbProvider"); + + // [databind#2462]: commons-configuration / -2 + s.add("org.apache.commons.configuration.JNDIConfiguration"); + s.add("org.apache.commons.configuration2.JNDIConfiguration"); + + // [databind#2469]: xalan2 + s.add("org.apache.xalan.lib.sql.JNDIConnectionPool"); + + // [databind#2478]: comons-dbcp, p6spy + s.add("org.apache.commons.dbcp.datasources.PerUserPoolDataSource"); + s.add("org.apache.commons.dbcp.datasources.SharedPoolDataSource"); + s.add("com.p6spy.engine.spy.P6DataSource"); + + // [databind#2498]: log4j-extras (1.2) + s.add("org.apache.log4j.receivers.db.DriverManagerConnectionSource"); + s.add("org.apache.log4j.receivers.db.JNDIConnectionSource"); + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); }