From 43a201fb1b645aa07d02f7723fa3e9b07ef2c232 Mon Sep 17 00:00:00 2001 From: Wolfgang Kozian Date: Wed, 30 Sep 2026 22:17:59 +0200 Subject: [PATCH] fix(security): jackson-bom 2.21.5 -> 2.21.7 (CVE-2026-68497 + 2 more HIGH) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nightly Trivy scan went red on 2026-09-29 and 2026-09-30 (issues #140, #141) with no code change on our side — CVE-2026-68497 (HIGH) was published against jackson-databind that day and our BOM override pinned 2.21.5. CVE-2026-68497: CoreXMLDeserializers hands a JSON *string* straight to DatatypeFactory.newDuration / newXMLGregorianCalendar, so BigInteger(String) and BigDecimal(String) parse arbitrarily long digit runs quadratically. Those deserializers are registered by default and jackson-core's maxNumberLength guard does not apply to string tokens, so a single few-MB unauthenticated request can burn minutes of single-threaded CPU. 2.21.6 is the version the advisory names, but verifying it against a current Trivy DB still failed the HIGH gate: CVE-2026-91776 (TypeDeserializerBase._findDeserializer) and CVE-2026-91777 (@JsonIdentityInfo forward-reference completion) are fixed only in 2.21.7. 2.21.7 is the newest release on Maven Central. It also clears three mediums: CVE-2026-83557, CVE-2026-19032, CVE-2026-77310. jackson-databind is transitive-only here, so Dependabot's direct-only security updater cannot patch it (the recurring security_update_dependency_not_found failures on the gradle jobs) — the shared jackson-bom property override is the fix, and it moves the whole Jackson family together. Verified locally: - ./gradlew test bootJar -> BUILD SUCCESSFUL, 382 tests, 0 failures - trivy 0.70.0 fs --severity HIGH,CRITICAL (same version as CI) -> 0 findings, exit 0 (was exit 1 with 2 HIGH on 2.21.6) Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_013U7fTQGgewiKtW8N9ikHBi --- backend/build.gradle.kts | 21 ++++++++++++++++----- backend/gradle.lockfile | 18 +++++++++--------- 2 files changed, 25 insertions(+), 14 deletions(-) diff --git a/backend/build.gradle.kts b/backend/build.gradle.kts index 135501a..fbc2fe9 100644 --- a/backend/build.gradle.kts +++ b/backend/build.gradle.kts @@ -61,13 +61,24 @@ dependencies { // Security override of a Spring Boot 3.5.16 BOM-managed transitive version. // commons-lang3 3.17.0 -> 3.18.0 fixes CVE-2025-48924 (BOM pins 3.17.0 even though swagger-core wants 3.20.0). extra["commons-lang3.version"] = "3.18.0" -// jackson-bom 2.21.4 -> 2.21.5 fixes @JsonView bypass CVEs on jackson-databind -// (GHSA-mhm7-754m-9p8w and GHSA-5gvw-p9qm-jgwh / CVE-2026-59889, both medium; Dependabot #80/#81). -// 2.21.5 shipped to Maven Central; Spring Boot 3.5.16 BOM still pins 2.21.4. Override the shared -// jackson-bom property so the whole Jackson family (databind, core, module-kotlin, ...) moves together. +// jackson-bom 2.21.5 -> 2.21.7 clears the whole current HIGH set on jackson-databind: +// - CVE-2026-68497 (Dependabot #102, what turned the nightly Trivy gate red on 2026-09-29): +// CoreXMLDeserializers passes a JSON *string* straight into DatatypeFactory.newDuration / +// newXMLGregorianCalendar, so BigInteger(String)/BigDecimal(String) parse arbitrarily long digit +// runs quadratically. Those deserializers are on by default and jackson-core's maxNumberLength +// guard does not apply to string tokens, so a few-MB unauthenticated request burns minutes of CPU. +// - CVE-2026-91776 (TypeDeserializerBase._findDeserializer) and CVE-2026-91777 (@JsonIdentityInfo +// forward-reference completion), both fixed only in 2.21.7. 2.21.6 was verified against a current +// Trivy DB and still failed the HIGH gate on these two, so 2.21.6 is NOT sufficient. +// 2.21.7 also clears three mediums: CVE-2026-83557, CVE-2026-19032, CVE-2026-77310 (Dependabot #103/#101/#100). +// Earlier: 2.21.4 -> 2.21.5 fixed the @JsonView bypass CVEs (GHSA-mhm7-754m-9p8w, +// GHSA-5gvw-p9qm-jgwh / CVE-2026-59889; Dependabot #80/#81). +// 2.21.7 is the newest release on Maven Central (2.21.8 is not published); Spring Boot 3.5.16 BOM +// still pins 2.21.4. Override the shared jackson-bom property so the whole Jackson family +// (databind, core, module-kotlin, ...) moves together. // jackson-databind is transitive-only here, so Dependabot's direct-only security update could not patch // it (security_update_dependency_not_found) — this BOM override is the fix. -extra["jackson-bom.version"] = "2.21.5" +extra["jackson-bom.version"] = "2.21.7" // logback-core 1.5.34 -> 1.5.35 fixes CVE (object injection via HardenedObjectInputStream, Dependabot #79). // Spring Boot 3.5.16 BOM pins 1.5.34; override the shared property so logback-core AND logback-classic move together. extra["logback.version"] = "1.5.35" diff --git a/backend/gradle.lockfile b/backend/gradle.lockfile index a1bee43..9f4c9b0 100644 --- a/backend/gradle.lockfile +++ b/backend/gradle.lockfile @@ -5,15 +5,15 @@ ch.qos.logback:logback-classic:1.5.35=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath ch.qos.logback:logback-core:1.5.35=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.core:jackson-core:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.core:jackson-databind:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.module:jackson-module-kotlin:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson.module:jackson-module-parameter-names:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath -com.fasterxml.jackson:jackson-bom:2.21.5=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-core:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.dataformat:jackson-dataformat-toml:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.module:jackson-module-kotlin:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.module:jackson-module-parameter-names:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson:jackson-bom:2.21.7=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.fasterxml:classmate:1.7.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.github.docker-java:docker-java-api:3.4.2=testCompileClasspath,testRuntimeClasspath com.github.docker-java:docker-java-transport-zerodep:3.4.2=testCompileClasspath,testRuntimeClasspath