Block one more gadget type (activemq-pool[-jms], CVE-2020-11111) #2664
Comments
cowtowncoder
changed the title
cowtowncoder
added
2.9
CVE
cowtowncoder
changed the title
cowtowncoder
added a commit
that referenced
this issue
Mar 26, 2020
cowtowncoder
changed the title
cowtowncoder
changed the title
|
Do you have an estimated date for 2.9.10.4 release? |
|
No firm date. It will keep moving as long as I keep receiving new reports. But hoping it may be done over upcoming weekend (4th - 5th april). |
martokarski
pushed a commit
to atlassian/jackson-1
that referenced
this issue
May 8, 2020
qxo
added a commit
to qxo/jackson-databind
that referenced
this issue
Sep 21, 2020
…L#2659 FasterXML#2660 FasterXML#2662 FasterXML#2664 FasterXML#2666 FasterXML#2670 FasterXML#2680 FasterXML#2682 FasterXML#2688 FasterXML#2698 FasterXML#2704 FasterXML#2765 FasterXML#2798 FasterXML#2814 FasterXML#2826 FasterXML#2827 FasterXML#2854 1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
cowtowncoder
pushed a commit
that referenced
this issue
Sep 22, 2020
#2670 #2680 #2682 #2688 #2698 #2704 #2765 #2798 #2814 #2826 #2827 #2854 (#2858) 1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Another gadget type(s) reported regarding classes of
org.apache.activemq:activemq-pool,org.apache.activemq:activemq-pool-jmslibraries.See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.
Mitre id: CVE-2020-11111
Reporter: Srikanth Ramu
Fix will be included in:
The text was updated successfully, but these errors were encountered: