debian/changelog

+jackson-databind (2.8.6-1+deb9u5) stretch-security; urgency=high
+
+  * Team upload.
+  * Fix CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718,
+    CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360,
+    CVE-2018-19361, CVE-2018-19362 and CVE-2019-12086.
+    Several deserialization flaws were discovered in jackson-databind which
+    could allow an unauthenticated user to perform code execution. The issue
+    was resolved by extending the blacklist and blocking more classes from
+    polymorphic deserialization.
+
+ -- Markus Koschany <apo@debian.org>  Sun, 19 May 2019 00:04:32 +0200
+
 jackson-databind (2.8.6-1+deb9u4) stretch-security; urgency=high
 
   * Team upload.

debian/patches/CVE-2018-11307.patch

+From: Markus Koschany <apo@debian.org>
+Date: Thu, 16 May 2019 20:53:06 +0200
+Subject: CVE-2018-11307
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2032
+Origin: https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb737
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java   | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -79,6 +79,8 @@ public class BeanDeserializerFactory
+         // [databind#1899]: more 3rd party
+         s.add("org.hibernate.jmx.StatisticsService");
+         s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
++        // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities
++        s.add("org.apache.ibatis.parsing.XPathParser");
+ 
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }

debian/patches/CVE-2018-12022.patch

+From: Markus Koschany <apo@debian.org>
+Date: Thu, 16 May 2019 20:52:36 +0200
+Subject: CVE-2018-12022
+
+This is also the fix for CVE-2018-12023.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2052
+Origin: https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a1
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java   | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -82,6 +82,12 @@ public class BeanDeserializerFactory
+         // [databind#2032]: more 3rd party; data exfiltration via xml parsed ext entities
+         s.add("org.apache.ibatis.parsing.XPathParser");
+ 
++        // [databind#2052]: ldap approaches; in all cases LDAP connection String is passed
++        //   and access attempt is made:
++        s.add("oracle.jdbc.connector.OracleManagedConnectionFactory");
++        s.add("jodd.db.connection.DataSourceConnectionProvider");
++        s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 

debian/patches/CVE-2018-14718.patch

+From: Markus Koschany <apo@debian.org>
+Date: Thu, 16 May 2019 20:50:50 +0200
+Subject: CVE-2018-14718
+
+This is also the fix for CVE-2018-14719, CVE-2018-14720, CVE-2018-14721.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2097
+Origin: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java   | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -88,6 +88,12 @@ public class BeanDeserializerFactory
+         s.add("jodd.db.connection.DataSourceConnectionProvider");
+         s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
+ 
++        // [databind#2097]: some 3rd party, one JDK-bundled
++        s.add("org.slf4j.ext.EventData");
++        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
++        s.add("com.sun.deploy.security.ruleset.DRSHelper");
++        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 

debian/patches/CVE-2018-19360.patch

+From: Markus Koschany <apo@debian.org>
+Date: Thu, 16 May 2019 20:41:44 +0200
+Subject: CVE-2018-19360
+
+This is also the fix for CVE-2018-19361 and CVE-2018-19362.
+
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
+Origin: https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
+---
+ .../fasterxml/jackson/databind/deser/BeanDeserializerFactory.java   | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -94,6 +94,12 @@ public class BeanDeserializerFactory
+         s.add("com.sun.deploy.security.ruleset.DRSHelper");
+         s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+ 
++        // [databind#2186]: yet more 3rd party gadgets
++        s.add("org.jboss.util.propertyeditor.DocumentEditor");
++        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
++        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
++        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 

debian/patches/CVE-2019-12086.patch

+From: Markus Koschany <apo@debian.org>
+Date: Sun, 19 May 2019 00:02:45 +0200
+Subject: CVE-2019-12086
+
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929177
+Bug-Upstream: https://github.com/FasterXML/jackson-databind/issues/2326
+Origin: https://github.com/FasterXML/jackson-databind/commit/dda513bd7251b4f32b7b60b1c13740e3b5a43024
+---
+ .../com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java  | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+index 866f9cf..c22653a 100644
+--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
++++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+@@ -100,6 +100,9 @@ public class BeanDeserializerFactory
+         s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
+         s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
+ 
++        // [databind#2326] (2.9.9): one more 3rd party gadget
++        s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
++
+         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
+     }
+ 

debian/patches/series

@@ -5,3 +5,8 @@ CVE-2017-15095_3.patch
 CVE-2018-5968.patch
 CVE-2017-17485.patch
 CVE-2018-7489.patch
+CVE-2018-11307.patch
+CVE-2018-12022.patch
+CVE-2018-14718.patch
+CVE-2018-19360.patch
+CVE-2019-12086.patch