Overview
About vulnerability
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.Details
- Affected product:
- AlmaLinux 9.2 ESU , Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Apache Struts , Elasticsearch , Gradle , Hazelcast , Hibernate , Jackson , OpenSearch , Spring , TuxCare 9.6 ESU , Wildfly , accumulo , activemq , agepredictor , archaius , artemis , avro , aws-java-sdk-xray , aws-sdk-java , aws-xray-sdk-java , azure-sdk-for-java , azure-spring-data-cosmos , bookkeeper , bookkeeper-common-allocator , calcite , camel , cassandra-java-driver , com.wavefront:wavefront-sdk-java , consul-client , corda , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , debezium , distributedlog , docker-java , docx4j , droolsjbpm-integration , etcd4j , eureka , flink , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , graphql-java-servlet , groovy , hbase , http-client , hystrix , incubator-retired-htrace , infinispan , jasperreports , java-apns , java-cas-client , java-driver , java-genai , java-jwt , java-opensaml , jersey , jgroups-aws , jjwt , json-patch , json-schema-core , json-schema-validator , jsonpath , jsonschema-generator , karaf , kubernetes-client , logging-flume , micrometer , micrometer-tracing , micronaut-cache , micronaut-core , micronaut-spring , neo4j-ogm , olingo-odata4 , openstack4j , org.apache.groovy:groovy-all , parquet-java , pinecone-java-client , pulsar , pulsar-client-reactive , redisson , rescu , rest-assured , resteasy , ribbon , signalfx-java , smallrye-open-api , swagger-core , swagger-parser , testcontainers-java , tika , tinkerpop , trendrrnsqclient , twilio-java , typesense-java , vert.x , wavefront-internal-reporter-java , web3j , wiremock , ws-wss4j , xchange , zendesk-java-client
- Affected packages:
- Spring Integration @ 5.5.19 (+9948 more)