Overview
About vulnerability
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.Details
- Affected product:
- AlmaLinux 9.2 ESU , Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Solr , Apache Spark , Apache Struts , Hibernate , Jackson , Spring , TuxCare 9.6 ESU , Wildfly , accumulo , activemq , agepredictor , archaius , avro , aws-java-sdk-xray , aws-sdk-java , aws-xray-sdk-java , azure-sdk-for-java , calcite , camel , cassandra-java-driver , consul-client , corda , couchbase-jvm-clients , debezium , docker-java , docx4j , droolsjbpm-integration , elasticsearch , etcd4j , flink , gradle , grails-core , hazelcast , hbase , http-client , hystrix , incubator-retired-htrace , jasperreports , java-apns , java-cas-client , java-driver , java-jwt , java-opensaml , jersey , json-patch , json-schema-validator , karaf , kubernetes-client , logging-flume , micronaut-core , neo4j-ogm , olingo-odata4 , opensearch , openstack4j , parquet-java , pulsar , rescu , ribbon , smallrye-open-api , swagger-core , swagger-parser , tika , tinkerpop , trendrrnsqclient , twilio-java , vert.x , web3j , wildfly , ws-wss4j , xchange , zendesk-java-client
- Affected packages:
- activemq-http @ 5.18.3 (+6055 more)