From 9cf896a790b10838da79563e842b636dff23a3c5 Mon Sep 17 00:00:00 2001 From: wang_yue111 <648774160@qq.com> Date: Mon, 18 Jan 2021 18:49:20 +0800 Subject: [PATCH] fix CVE-2020-36185 --- CVE-2020-36185.patch | 28 ++++++++++++++++++++++++++++ jackson-databind.spec | 6 +++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 CVE-2020-36185.patch diff --git a/CVE-2020-36185.patch b/CVE-2020-36185.patch new file mode 100644 index 0000000..ac29432 --- /dev/null +++ b/CVE-2020-36185.patch @@ -0,0 +1,28 @@ +From 2cf1231703fa3a348ada8fa4491c96ee747bf7ed Mon Sep 17 00:00:00 2001 +From: Tatu Saloranta +Date: Mon, 18 Jan 2021 18:30:47 +0800 +Subject: [PATCH] Fixed #2998 + +--- + .../jackson/databind/jsontype/impl/SubTypeValidator.java | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +index 3e52fb7..9df94ec 100644 +--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java ++++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +@@ -210,6 +210,11 @@ public class SubTypeValidator + // (derivative of #2469) + s.add("com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool"); + ++ // [databind#2998]: org.apache.tomcat/tomcat-dbcp (embedded dbcp 2.x) ++ // (derivative of #2478) ++ s.add("org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource"); ++ s.add("org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource"); ++ + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); + } + +-- +2.23.0 + diff --git a/jackson-databind.spec b/jackson-databind.spec index 05c9a11..a9aedd2 100644 --- a/jackson-databind.spec +++ b/jackson-databind.spec @@ -1,6 +1,6 @@ Name: jackson-databind Version: 2.9.8 -Release: 4 +Release: 5 Summary: General data-binding package for Jackson (2.x) License: ASL 2.0 and LGPLv2+ URL: https://github.com/FasterXML/jackson-databind/ @@ -40,6 +40,7 @@ Patch0031: CVE-2020-24616.patch Patch0032: CVE-2020-25649.patch Patch0033: CVE-2020-35490-CVE-2020-35491.patch Patch0034: CVE-2020-35728.patch +Patch0035: CVE-2020-36185.patch BuildRequires: maven-local mvn(com.fasterxml.jackson.core:jackson-annotations) >= %{version} BuildRequires: mvn(com.fasterxml.jackson.core:jackson-core) >= %{version} @@ -92,6 +93,9 @@ rm src/test/java/com/fasterxml/jackson/databind/ser/jdk/JDKTypeSerializationTest %license LICENSE NOTICE %changelog +* Mon Jan 18 2021 wangyue - 2.9.8-5 +- fix CVE-2020-36185 + * Mon Jan 11 2021 wangxiao - 2.9.8-4 - fix CVE-2020-35490 CVE-2020-35491 CVE-2020-35728