Block one more gadget type (jaxp-ri, CVE-2020-14062) #2704
Comments
cowtowncoder
added a commit
that referenced
this issue
May 2, 2020
martokarski
pushed a commit
to atlassian/jackson-1
that referenced
this issue
May 8, 2020
cowtowncoder
changed the title
cowtowncoder
changed the title
cowtowncoder
changed the title
cowtowncoder
changed the title
qxo
added a commit
to qxo/jackson-databind
that referenced
this issue
Sep 21, 2020
…L#2659 FasterXML#2660 FasterXML#2662 FasterXML#2664 FasterXML#2666 FasterXML#2670 FasterXML#2680 FasterXML#2682 FasterXML#2688 FasterXML#2698 FasterXML#2704 FasterXML#2765 FasterXML#2798 FasterXML#2814 FasterXML#2826 FasterXML#2827 FasterXML#2854 1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
cowtowncoder
pushed a commit
that referenced
this issue
Sep 22, 2020
#2670 #2680 #2682 #2688 #2698 #2704 #2765 #2798 #2814 #2826 #2827 #2854 (#2858) 1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Another gadget type(s) reported regarding class(es) of
com.sun.xml.parsers:jaxp-ri(in shaded copy of Xalan2).See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.
Mitre id: CVE-2020-14062
Reporter(s): XuYuanzhen from Security Team of Alibaba Cloud
Fix will be included in:
The text was updated successfully, but these errors were encountered: