Jackson-databind: Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)

[cowtowncoder]

Another gadget (*) type reported related to JNDI access.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-8840
Original discoverer: @threedr3am

Fixed in:

• 2.9.10.3 (jackson-bom version 2.9.10.20200223)
• 2.8.11.5 (jackson-bom version 2.8.11.20200210)
• 2.7.9.7
• does not affect 2.10.0 and later

[attritionorg]

@cowtowncoder Is there an ETA on releasing 2.9.10.3? Thanks!

[cowtowncoder]

I hope to have time to do the micro-patch release this by end of the week.

[cowtowncoder]

Release making its way to Maven Central now.

[nobdy]

[NOTE: a placeholder until complete information gathered]

Another gadget (*) type reported related to JNDI access.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2020-8840
Original discoverer: @threedr3am

Fixed in:

• 2.9.10.3 (released 2019-02-23; jackson-bom version 2.9.10.20200223)
• 2.8.11.5
• does not affect 2.10.0 and later

Was released 2020-02-23 wrongly written as released 2019-02-23?

[GodIsDevil]

What about 2.7.x?

[cowtowncoder]

@nobdy yes, thank you for pointing that out.

@GodIsDevil no plans to backport to versions prior to 2.8.x.