Is jackson 2.13.x going to receive a patch for CVE-2022-42003? #126
-
|
I wanted to inquire whether 2.13 is vulnerable to CVE-2022-42003 (dependabot indicates so) and whether a patch will be back ported. |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 7 replies
-
|
Do you enable the non-default UNWRAP_SINGLE_VALUE_ARRAYS setting? If not, you are unaffected by that CVE. |
Beta Was this translation helpful? Give feedback.
-
|
No plans for backporting at this point. EDIT: the main reason for not backporting is since this is technically behavioral change that could break some usage; specifically if some code assumes that multiple nested Arrays may be used (and unwrapped). Since the likelihood seems small (and there being a security issue) I am comfortable changing this -- without any way to to use old behavior -- in a minor release, but less so in a patch. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, Do you have plans to release 2.14 or 3.0 with a fix for CVW-2022-42003? Pavlin |
Beta Was this translation helpful? Give feedback.
-
|
2.14.0 will be released when it is ready - probably within a few weeks |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the swift response! Could you be a bit more specific on the few weeks, please? Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
@pinpan This is a volunteer project with variable time to spend on fixes AND releases (full release takes 3-4 hours). But I do hope to get 2.14.0 released by end of October so yes, 3-4 weeks. |
Beta Was this translation helpful? Give feedback.
-
|
@cowtowncoder, thank you for the confirmation! |
Beta Was this translation helpful? Give feedback.
-
|
Ok, I may have changed my mind, with a little bit of help from my friends: FasterXML/jackson-databind#3621 which would go in 2.13.4.1 micro-patch of |
Beta Was this translation helpful? Give feedback.
-
|
yay! TYSM |
Beta Was this translation helpful? Give feedback.
-
|
No problem @jsadn. In the end this made lots of sense. |
Beta Was this translation helpful? Give feedback.
No plans for backporting at this point.
EDIT: the main reason for not backporting is since this is technically behavioral change that could break some usage; specifically if some code assumes that multiple nested Arrays may be used (and unwrapped). Since the likelihood seems small (and there being a security issue) I am comfortable changing this -- without any way to to use old behavior -- in a minor release, but less so in a patch.