Описание
Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-bom:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
Changes for jackson-dataformats-binary:
- Update to 2.18.9.
Changes for jackson-modules-base:
- Update to 2.18.9.
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Development Tools 15 SP7
Ссылки
- Link for SUSE-SU-2026:3273-1
- E-Mail link for SUSE-SU-2026:3273-1
- SUSE Security Ratings
- SUSE Bug 1268902
- SUSE Bug 1271440
- SUSE Bug 1271442
- SUSE CVE CVE-2026-54515 page
- SUSE CVE CVE-2026-59888 page
- SUSE CVE CVE-2026-59889 page
Описание
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map - restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Затронутые продукты
Ссылки
- CVE-2026-54515
- SUSE Bug 1268902
Описание
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Затронутые продукты
Ссылки
- CVE-2026-59888
- SUSE Bug 1271442
Описание
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Затронутые продукты
Ссылки
- CVE-2026-59889
- SUSE Bug 1271440