CVE-2020-28491

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 2.8.0-rc1 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

This module is a multi-module umbrella project for Jackson standard binary dataformat backends. Dataformat backends are used to support format alternatives to JSON, using general-purpose Jackson API. Formats included allow access using all 3 API styles (streaming, databinding, tree model).

Security Fix(es):

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.(CVE-2020-28491)

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.10.0.rhlw-00001 with a backported security fix.

CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

This patched artifact is a drop-in replacement for com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.10.0 from Maven Central.

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.9.10.rhlw-00001 with a backported security fix.

CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

This patched artifact is a drop-in replacement for com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.9.10 from Maven Central.

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

These are all security issues fixed in the jackson-dataformat-cbor-2.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2020-28491 in the io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package for Root:Maven. Multiple fixed versions available.

This update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core fixes the following issues:

Security issues fixed:

• CVE-2020-36518: Fixed a Java stack overflow exception and denial of service via a large depth of nested objects in jackson-databind. (bsc#1197132)
• CVE-2020-25649: Fixed an insecure entity expansion in jackson-databind which was vulnerable to XML external entity (XXE). (bsc#1177616)
• CVE-2020-28491: Fixed a bug which could cause java.lang.OutOfMemoryError exception in jackson-dataformats-binary. (bsc#1182481)

Non security fixes:

jackson-annotations - update from version 2.10.2 to version 2.13.0:

• Build with source/target levels 8
• Add 'mvnw' wrapper
• 'JsonSubType.Type' should accept array of names
• Jackson version alignment with Gradle 6
• Add '@JsonIncludeProperties'
• Add '@JsonTypeInfo(use=DEDUCTION)'
• Ability to use '@JsonAnyGetter' on fields
• Add '@JsonKey' annotation
• Allow repeated calls to 'SimpleObjectIdResolver.bindItem()' for same mapping
• Add 'namespace' property for '@JsonProperty' (for XML module)
• Add target 'ElementType.ANNOTATION_TYPE' for '@JsonEnumDefaultValue'
• 'JsonPattern.Value.pattern' retained as '', never (accidentally) exposed as 'null'
• Rewrite to use ant for building in order to be able to use it in packages that have to be built before maven

jackson-bom - update from version 2.10.2 to version 2.13.0:

• Configure moditect plugin with '<jvmVersion>11</jvmVersion>'
• jackson-bom manages the version of 'junit:junit'
• Drop 'jackson-datatype-hibernate3' (support for Hibernate 3.x datatypes)
• Removed 'jakarta' classifier variants of JAXB/JSON-P/JAX-RS modules due to the addition of new Jakarta artifacts (Jakarta-JSONP, Jakarta-xmlbind-annotations, Jakarta-rs-providers)
• Add version for 'jackson-datatype-jakarta-jsonp' module (introduced after 2.12.2)
• Add (beta) version for 'jackson-dataformat-toml'
• Jakarta 9 artifact versions are missing from jackson-bom
• Add default settings for 'gradle-module-metadata-maven-plugin' (gradle metadata)
• Add default settings for 'build-helper-maven-plugin'
• Drop 'jackson-module-scala_2.10' entry (not released for Jackson 2.12 or later)
• Add override for 'version.plugin.bundle' (for 5.1.1) to help build on JDK 15+
• Add missing version for jackson-datatype-eclipse-collections

jackson-core - update from version 2.10.2 to version 2.13.0:

• Build with source and target levels 8
• Misleading exception for input source when processing byte buffer with start offset
• Escape contents of source document snippet for 'JsonLocation._appendSourceDesc()'
• Add 'StreamWriteException' type to eventually replace 'JsonGenerationException'
• Replace 'getCurrentLocation()'/'getTokenLocation()' with 'currentLocation()'/'currentTokenLocation()' in 'JsonParser'
• Replace 'JsonGenerator.writeObject()' (and related) with 'writePOJO()'
• Replace 'getCurrentValue()'/'setCurrentValue()' with 'currentValue()'/'assignCurrentValue()' in 'JsonParser'/'JsonGenerator
• Introduce O(n^1.5) BigDecimal parser implementation
• ByteQuadsCanonicalizer.addName(String, int, int) has incorrect handling for case of q2 == null
• UTF32Reader ArrayIndexOutOfBoundsException
• Improve exception/JsonLocation handling for binary content: don't show content, include byte offset
• Fix an issue with the TokenFilter unable to ignore properties when deserializing.
• Optimize array allocation by 'JsonStringEncoder'
• Add 'mvnw' wrapper
• (partial) Optimize array allocation by 'JsonStringEncoder'
• Add back accidentally removed 'JsonStringEncoder' related methods in 'BufferRecyclers' (like 'getJsonStringEncoder()')
• 'ArrayOutOfBoundException' at 'WriterBasedJsonGenerator.writeString(Reader, int)'
• Allow 'optional-padding' for 'Base64Variant'
• More customizable TokenFilter…