ALT-PU-2026-15480

Высокий

ALT-PU-2026-15480: package jackson-databind update to version 2.22.1-alt2

Источник

errata.altlinux.org

Дата публикации

18.09.2026

Дата обновления

18.09.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades jackson-databind to version 2.22.1-alt2.

Устраненные уязвимости4

CVE-2026-54512

Высокий 8.1

Дата публикации: 23.06.2026

CWE-184

CWE-502

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

CVSS 3.1

Высокий 8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Ссылки

CVE-2026-54512 https://nvd.nist.gov/vuln/detail/CVE-2026-54512

Ссылки5

ALT-PU-2026-15480 https://errata.altlinux.org/ALT-PU-2026-15480

GHSA-5jmj-h7xm-6q6v

https://github.com/advisories/GHSA-5jmj-h7xm-6q6v

GHSA-hgj6-7826-r7m5

https://github.com/advisories/GHSA-hgj6-7826-r7m5

GHSA-j3rv-43j4-c7qm

https://github.com/advisories/GHSA-j3rv-43j4-c7qm

GHSA-rmj7-2vxq-3g9f

https://github.com/advisories/GHSA-rmj7-2vxq-3g9f

Связанные уязвимости

openSUSE-SU-2026:21201-1

suse-cvrf

4 месяца назад

Security update for jackson-annotations, jackson-core, jackson-databind

SUSE-SU-2026:2801-1

suse-cvrf

4 месяца назад

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

RLSA-2026:43400

rocky

4 месяца назад

Important: dogtag-pki security update

RLSA-2026:40895

rocky

4 месяца назад

Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

ELSA-2026-43400

oracle-oval

4 месяца назад

ELSA-2026-43400: dogtag-pki security update (IMPORTANT)