From 588dfb1401c894cff8c45f3539d80c18abc10729 Mon Sep 17 00:00:00 2001 From: "Brian M. Carr" Date: Tue, 30 Jun 2026 11:56:34 -0500 Subject: [PATCH] Pin jackson-databind/core to 2.22.0 to clear 7 advisories All seven open Dependabot alerts (#9-#15) are jackson-databind (CVE-2026-54512 ... CVE-2026-54518): PolymorphicTypeValidator bypasses, @JsonView / @JsonIgnore / @JsonIgnoreProperties bypasses, and an InetSocketAddress eager-DNS SSRF. jackson is a transitive of the CycloneDX and JReleaser plugins, resolving to 2.21.2 on the buildscript classpath. Force-resolve jackson-databind and jackson-core to 2.22.0 in the existing buildscript resolutionStrategy block (alongside the tika-core and plexus-utils pins). 2.22.0 is the first published release exceeding every vulnerable range -- the named 2.21.5 fix was never released to Maven Central. jackson-annotations tracks its own 2.22 line via the BOM. Co-Authored-By: Claude Opus 4.8 (1M context) --- build.gradle.kts | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/build.gradle.kts b/build.gradle.kts index e2cefd2..34013f2 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -28,6 +28,25 @@ buildscript { useVersion("3.6.1") because("Dependabot alert #4: plexus-utils directory traversal (GHSA-6fmv-xxpf-w3cw)") } + /* + * https://github.com/hotelengine/protoc-utils/security/dependabot/9 + * … through https://github.com/hotelengine/protoc-utils/security/dependabot/15 + * Seven jackson-databind advisories — PolymorphicTypeValidator bypasses + * (CVE-2026-54513, CVE-2026-54512), @JsonView / @JsonIgnore / + * @JsonIgnoreProperties bypasses (CVE-2026-54517, CVE-2026-54516, + * CVE-2026-54515, CVE-2026-54518), and InetSocketAddress eager-DNS SSRF + * (CVE-2026-54514). Transitive of the CycloneDX and JReleaser plugins. + * 2.22.0 is the first published release exceeding every vulnerable range — + * the named 2.21.5 fix (CVE-2026-54515) was never released to Maven Central. + * jackson-core is bumped in lock-step to avoid databind/core skew; + * jackson-annotations tracks its own 2.22 line via the BOM. + */ + if (requested.group == "com.fasterxml.jackson.core" && + (requested.name == "jackson-databind" || requested.name == "jackson-core") + ) { + useVersion("2.22.0") + because("Dependabot alerts #9-#15: jackson-databind PTV/@JsonView/@JsonIgnore bypasses and SSRF (CVE-2026-54512…54518)") + } } } }