!18 fix cves
From: @wang_yue111 Reviewed-by: @zhanghua1831,@small_leek,@wangchong1995924 Signed-off-by: @small_leek,@wangchong1995924
This commit is contained in:
openeuler-ci-bot
Gitee
commit
b2cd76eab5
71
CVE-2020-36179-36180-36181-36182.patch
Normal file
71
CVE-2020-36179-36180-36181-36182.patch
Normal file
@ -0,0 +1,71 @@
|
||||
From 3712a09e9ae5da3dbbaa0fbcf75114f25557171e Mon Sep 17 00:00:00 2001
|
||||
From: Tatu Saloranta <tatu.saloranta@iki.fi>
|
||||
Date: Thu, 21 Jan 2021 17:36:28 +0800
|
||||
Subject: [PATCH] Fixed #3004
|
||||
|
||||
---
|
||||
.../jsontype/impl/SubTypeValidator.java | 18 ++++++++++++------
|
||||
1 file changed, 12 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
index 2fda051..787e573 100644
|
||||
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
@@ -118,9 +118,12 @@ public class SubTypeValidator
|
||||
// [databind#2704]: xalan2
|
||||
s.add("com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool");
|
||||
|
||||
- // [databind#2478]: comons-dbcp, p6spy
|
||||
+ // [databind#2478]: commons-dbcp 1.x, p6spy
|
||||
+ // [databind#3004]: commons-dbcp 1.x
|
||||
+ s.add("org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS");
|
||||
s.add("org.apache.commons.dbcp.datasources.PerUserPoolDataSource");
|
||||
s.add("org.apache.commons.dbcp.datasources.SharedPoolDataSource");
|
||||
+
|
||||
s.add("com.p6spy.engine.spy.P6DataSource");
|
||||
|
||||
// [databind#2498]: log4j-extras (1.2)
|
||||
@@ -184,9 +187,9 @@ public class SubTypeValidator
|
||||
// [databind#2682]: commons-jelly
|
||||
s.add("org.apache.commons.jelly.impl.Embedded");
|
||||
|
||||
- // [databind#2688]: apache/drill
|
||||
+ // [databind#2688], [databind#3004]: apache/drill
|
||||
s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool");
|
||||
-
|
||||
+ s.add("oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS");
|
||||
// [databind#2698]: weblogic w/ oracle/aq-jms
|
||||
// (note: dependency not available via Maven Central, but as part of
|
||||
// weblogic installation, possibly fairly old version(s))
|
||||
@@ -202,9 +205,10 @@ public class SubTypeValidator
|
||||
// [databind#2798]: com.pastdev.httpcomponents:
|
||||
s.add("com.pastdev.httpcomponents.configuration.JndiConfiguration");
|
||||
|
||||
- // [databind#2986]: dbcp2
|
||||
+ // [databind#2986], [databind#3004]: dbcp2
|
||||
s.add("org.apache.commons.dbcp2.datasources.PerUserPoolDataSource");
|
||||
s.add("org.apache.commons.dbcp2.datasources.SharedPoolDataSource");
|
||||
+ s.add("org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS");
|
||||
|
||||
// [databind#2999]: org.glassfish.web/javax.servlet.jsp.jstl (embedded Xalan)
|
||||
// (derivative of #2469)
|
||||
@@ -220,12 +224,14 @@ public class SubTypeValidator
|
||||
s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource");
|
||||
s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource");
|
||||
|
||||
- // [databind#2997]: tomcat/naming-factory-dbcp (embedded dbcp 1.x)
|
||||
+ // [databind#2997]/[databind#3004]: tomcat/naming-factory-dbcp (embedded dbcp 1.x)
|
||||
// (derivative of #2478)
|
||||
+ s.add("org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS");
|
||||
s.add("org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource");
|
||||
s.add("org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource");
|
||||
- // [databind#2998]: org.apache.tomcat/tomcat-dbcp (embedded dbcp 2.x)
|
||||
+ // [databind#2998]/[databind#3004]: org.apache.tomcat/tomcat-dbcp (embedded dbcp 2.x)
|
||||
// (derivative of #2478)
|
||||
+ s.add("org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS");
|
||||
s.add("org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource");
|
||||
s.add("org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource");
|
||||
|
||||
--
|
||||
2.23.0
|
||||
|
||||
27
CVE-2020-36184-CVE-2020-36185.patch
Normal file
27
CVE-2020-36184-CVE-2020-36185.patch
Normal file
@ -0,0 +1,27 @@
|
||||
From d8b91e1b94096f26443457463efeb0eb7f3477c8 Mon Sep 17 00:00:00 2001
|
||||
From: Tatu Saloranta <tatu.saloranta@iki.fi>
|
||||
Date: Thu, 21 Jan 2021 15:36:41 +0800
|
||||
Subject: [PATCH] Fixed #2998
|
||||
|
||||
---
|
||||
.../jackson/databind/jsontype/impl/SubTypeValidator.java | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
index 2be6d49..2fda051 100644
|
||||
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
@@ -224,6 +224,10 @@ public class SubTypeValidator
|
||||
// (derivative of #2478)
|
||||
s.add("org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource");
|
||||
s.add("org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource");
|
||||
+ // [databind#2998]: org.apache.tomcat/tomcat-dbcp (embedded dbcp 2.x)
|
||||
+ // (derivative of #2478)
|
||||
+ s.add("org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource");
|
||||
+ s.add("org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource");
|
||||
|
||||
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
|
||||
}
|
||||
--
|
||||
2.23.0
|
||||
|
||||
28
CVE-2020-36187-CVE-2020-36186.patch
Normal file
28
CVE-2020-36187-CVE-2020-36186.patch
Normal file
@ -0,0 +1,28 @@
|
||||
From 706f47b898fcc614447ad8c97276df12f9a9f391 Mon Sep 17 00:00:00 2001
|
||||
From: Tatu Saloranta <tatu.saloranta@iki.fi>
|
||||
Date: Thu, 21 Jan 2021 15:32:20 +0800
|
||||
Subject: [PATCH] Fixed #2997
|
||||
|
||||
---
|
||||
.../jackson/databind/jsontype/impl/SubTypeValidator.java | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
index 94f2b95..2be6d49 100644
|
||||
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
@@ -220,6 +220,11 @@ public class SubTypeValidator
|
||||
s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource");
|
||||
s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource");
|
||||
|
||||
+ // [databind#2997]: tomcat/naming-factory-dbcp (embedded dbcp 1.x)
|
||||
+ // (derivative of #2478)
|
||||
+ s.add("org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource");
|
||||
+ s.add("org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource");
|
||||
+
|
||||
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
|
||||
}
|
||||
|
||||
--
|
||||
2.23.0
|
||||
|
||||
28
CVE-2020-36188-CVE-2020-36189.patch
Normal file
28
CVE-2020-36188-CVE-2020-36189.patch
Normal file
@ -0,0 +1,28 @@
|
||||
From 506ad31e38a80f2862d85aa385c88496b3d341cb Mon Sep 17 00:00:00 2001
|
||||
From: Tatu Saloranta <tatu.saloranta@iki.fi>
|
||||
Date: Thu, 21 Jan 2021 15:26:02 +0800
|
||||
Subject: [PATCH] Fixed #2996
|
||||
|
||||
---
|
||||
.../jackson/databind/jsontype/impl/SubTypeValidator.java | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
index 9df94ec..94f2b95 100644
|
||||
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
|
||||
@@ -215,6 +215,11 @@ public class SubTypeValidator
|
||||
s.add("org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource");
|
||||
s.add("org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource");
|
||||
|
||||
+ // [databind#2996]: newrelic-agent + embedded-logback-core
|
||||
+ // (derivative of #2334 and #2389)
|
||||
+ s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource");
|
||||
+ s.add("com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource");
|
||||
+
|
||||
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
|
||||
}
|
||||
|
||||
--
|
||||
2.23.0
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
Name: jackson-databind
|
||||
Version: 2.9.8
|
||||
Release: 5
|
||||
Release: 6
|
||||
Summary: General data-binding package for Jackson (2.x)
|
||||
License: ASL 2.0 and LGPLv2+
|
||||
URL: https://github.com/FasterXML/jackson-databind/
|
||||
@ -41,6 +41,11 @@ Patch0032: CVE-2020-25649.patch
|
||||
Patch0033: CVE-2020-35490-CVE-2020-35491.patch
|
||||
Patch0034: CVE-2020-35728.patch
|
||||
Patch0035: CVE-2020-36185.patch
|
||||
Patch0036: CVE-2020-36188-CVE-2020-36189.patch
|
||||
Patch0037: CVE-2020-36187-CVE-2020-36186.patch
|
||||
Patch0038: CVE-2020-36184-CVE-2020-36185.patch
|
||||
#The CVE-2020-36179-36180-36181-36182.patch is used to fix CVE-2020-36179 and CVE-2020-36180 and CVE-2020-36181 and CVE-2020-36182
|
||||
Patch0039: CVE-2020-36179-36180-36181-36182.patch
|
||||
|
||||
BuildRequires: maven-local mvn(com.fasterxml.jackson.core:jackson-annotations) >= %{version}
|
||||
BuildRequires: mvn(com.fasterxml.jackson.core:jackson-core) >= %{version}
|
||||
@ -93,6 +98,11 @@ rm src/test/java/com/fasterxml/jackson/databind/ser/jdk/JDKTypeSerializationTest
|
||||
%license LICENSE NOTICE
|
||||
|
||||
%changelog
|
||||
* Thu Jan 21 2021 wangyue <wangyue92@huawei.com> - 2.9.8-6
|
||||
- fix CVE-2020-36185 CVE-2020-36188 CVE-2020-36189 CVE-2020-36187
|
||||
CVE-2020-36186 CVE-2020-36184 CVE-2020-36185 CVE-2020-36179
|
||||
CVE-2020-36180 CVE-2020-36181 CVE-2020-36182
|
||||
|
||||
* Mon Jan 18 2021 wangyue <wangyue92@huaweo.com> - 2.9.8-5
|
||||
- fix CVE-2020-36185
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user