Jackson-databind: Resolve Default Typing data-leak vulnerability (CVE-2019-12814)

[AKGarland]

A data vulnerability has been reported when Default Typing is enabled for externally exposed JSON endpoints.

Further details here

[jdelta-RBS]

Issue #2341 dealt with this.

[cowtowncoder]

Yes, I think this is dup of #2341, fixed in codebase and waiting for release of either 2.9.9.1 or 2.9.10 (depending on whether there are enough fixes to warrant a full release (latter), or just a jackson-databind micro-patch (former).

I have been on vacation for past 10 days (and will be out for another week now), so fix is likely to be out by mid-July

[alainmoran]

Unfortunately the decision to release this as 2.9.9.1 means that the owasp dependency-check-maven plugin still flags this version as vulnerable.

To my mind resolving a vulnerability should be enough to merit a full release.

[cowtowncoder]

@alainmoran There will eventually be a full release when there are enough fixes to warrant my using half a work-day for unpaid work. But some users really wanted to get an update sooner so I instead spent 30 minutes to get an update. You are very welcome.

But I don't necessarily give a flying fuck about what some half-assed pisspoor security tool says or does -- it pisses me greatly that I have to waste my time to work around their limitations. Time that I could use for actually useful things.

And even adding this comment is similar pointless overhead.

[mecorusfc]

I tried 2.9.9.1. OWASP Dependency Checker still calls it out due to the versioning (that pesky semantic versioning). This means that other tools will call it out as well. Note that most companies now have to use tools like this to scan jar files for vulnerabilities because of regulations that have extremely large penalties associated with them. Do a google on the recent penalties from GDPR violations. You might be shocked.

What is the ETA for getting a 2.9.10 version and can you explain why it takes different amounts of time for those two version differences (2.9.9.1 versus 2.9.10)?

[elion]

@mecorusfc be so kind and create an issue to OWASP dependency-check for a false positive.

[mecorusfc]

I was able to get a clean scan now. First one didn't rebuild due to no code changes so I forced a rebuild and that caught the new dependency. No need for a false positive report. Looks like it is working now. Thanks for the quick response. Mike