diff --git a/boms/geode-all-bom/src/test/resources/expected-pom.xml b/boms/geode-all-bom/src/test/resources/expected-pom.xml index 79b610d6b3d6..5012661c9731 100644 --- a/boms/geode-all-bom/src/test/resources/expected-pom.xml +++ b/boms/geode-all-bom/src/test/resources/expected-pom.xml @@ -470,27 +470,27 @@ com.fasterxml.jackson.core jackson-annotations - 2.18.6 + 2.21 com.fasterxml.jackson.core jackson-core - 2.18.6 + 2.21.2 com.fasterxml.jackson.core jackson-databind - 2.18.6 + 2.21.2 com.fasterxml.jackson.datatype jackson-datatype-joda - 2.18.6 + 2.21.2 com.fasterxml.jackson.datatype jackson-datatype-jsr310 - 2.18.6 + 2.21.2 com.jayway.jsonpath diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index 43d02ac333e4..468bd83c9115 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -44,8 +44,9 @@ class DependencyConstraints { deps.put("shiro.version", "1.13.0") deps.put("slf4j-api.version", "1.7.36") deps.put("jboss-modules.version", "1.11.0.Final") - deps.put("jackson.version", "2.18.6") - deps.put("jackson.databind.version", "2.18.6") + deps.put("jackson.version", "2.21.2") + deps.put("jackson.annotations.version", "2.21") + deps.put("jackson.databind.version", "2.21.2") deps.put("springshell.version", "1.2.0.RELEASE") deps.put("springframework.version", "5.3.20") @@ -179,8 +180,11 @@ class DependencyConstraints { entry('mockito-junit-jupiter') } - dependencySet(group: 'com.fasterxml.jackson.core', version: get('jackson.version')) { + dependencySet(group: 'com.fasterxml.jackson.core', version: get('jackson.annotations.version')) { entry('jackson-annotations') + } + + dependencySet(group: 'com.fasterxml.jackson.core', version: get('jackson.version')) { entry('jackson-core') } diff --git a/geode-assembly/src/distributedTest/java/org/apache/geode/management/JQFilterVerificationDUnitTest.java b/geode-assembly/src/distributedTest/java/org/apache/geode/management/JQFilterVerificationDUnitTest.java index e10dccbc233f..528a9d8ceb71 100644 --- a/geode-assembly/src/distributedTest/java/org/apache/geode/management/JQFilterVerificationDUnitTest.java +++ b/geode-assembly/src/distributedTest/java/org/apache/geode/management/JQFilterVerificationDUnitTest.java @@ -97,10 +97,10 @@ public static void beforeClass() throws IOException { client = new GeodeDevRestClient("/management", "localhost", locator.getHttpPort(), false); JsonNode jsonObject = client.doGetAndAssert("/v3/api-docs").getJsonObject().get("paths"); - Iterator> urls = jsonObject.fields(); + Iterator> urls = jsonObject.properties().iterator(); while (urls.hasNext()) { Map.Entry url = urls.next(); - Iterator> methods = url.getValue().fields(); + Iterator> methods = url.getValue().properties().iterator(); while (methods.hasNext()) { Map.Entry method = methods.next(); // gather all the rest endpoint that has jqFilter defined. diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index 32bf141b59da..9f38e0b8b8e1 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -1004,11 +1004,11 @@ lib/gfsh-dependencies.jar lib/httpclient-4.5.13.jar lib/httpcore-4.4.15.jar lib/istack-commons-runtime-4.0.1.jar -lib/jackson-annotations-2.18.6.jar -lib/jackson-core-2.18.6.jar -lib/jackson-databind-2.18.6.jar -lib/jackson-datatype-joda-2.18.6.jar -lib/jackson-datatype-jsr310-2.18.6.jar +lib/jackson-annotations-2.21.jar +lib/jackson-core-2.21.2.jar +lib/jackson-databind-2.21.2.jar +lib/jackson-datatype-joda-2.21.2.jar +lib/jackson-datatype-jsr310-2.21.2.jar lib/javax.activation-api-1.2.0.jar lib/javax.mail-api-1.6.2.jar lib/javax.resource-api-1.7.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index 4ff40e50a4b7..a1a3560272cb 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -21,11 +21,11 @@ spring-shell-1.2.0.RELEASE.jar spring-web-5.3.20.jar commons-lang3-3.12.0.jar rmiio-2.1.2.jar -jackson-datatype-joda-2.18.6.jar -jackson-annotations-2.18.6.jar -jackson-core-2.18.6.jar -jackson-datatype-jsr310-2.18.6.jar -jackson-databind-2.18.6.jar +jackson-datatype-joda-2.21.2.jar +jackson-annotations-2.21.jar +jackson-core-2.21.2.jar +jackson-datatype-jsr310-2.21.2.jar +jackson-databind-2.21.2.jar swagger-annotations-2.2.1.jar jopt-simple-5.0.4.jar log4j-slf4j-impl-2.17.2.jar diff --git a/geode-common/src/main/java/org/apache/geode/util/internal/GeodeJsonMapper.java b/geode-common/src/main/java/org/apache/geode/util/internal/GeodeJsonMapper.java index ebfef92acb37..2e08d8c44ed8 100644 --- a/geode-common/src/main/java/org/apache/geode/util/internal/GeodeJsonMapper.java +++ b/geode-common/src/main/java/org/apache/geode/util/internal/GeodeJsonMapper.java @@ -41,13 +41,15 @@ public static ObjectMapper getMapper() { .enable(JsonParser.Feature.ALLOW_SINGLE_QUOTES) .enable(MapperFeature.USE_BASE_TYPE_AS_DEFAULT_IMPL) .build(); - mapper.setSerializationInclusion(JsonInclude.Include.NON_EMPTY); + mapper.setDefaultPropertyInclusion( + JsonInclude.Value.construct(JsonInclude.Include.NON_EMPTY, JsonInclude.Include.NON_EMPTY)); return mapper; } public static ObjectMapper getMapperWithAlwaysInclusion() { ObjectMapper mapper = getMapper(); - mapper.setSerializationInclusion(JsonInclude.Include.ALWAYS); + mapper.setDefaultPropertyInclusion( + JsonInclude.Value.construct(JsonInclude.Include.ALWAYS, JsonInclude.Include.ALWAYS)); return mapper; } diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index 2d2e61b7b9ef..6bfbb3f0aaf5 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -9,7 +9,7 @@ spring-jcl-5.3.20.jar commons-codec-1.15.jar classgraph-4.8.147.jar commons-logging-1.3.5.jar -jackson-databind-2.18.6.jar +jackson-databind-2.21.2.jar geode-management-0.0.0.jar geode-core-0.0.0.jar javax.activation-api-1.2.0.jar @@ -44,7 +44,7 @@ rmiio-2.1.2.jar geode-tcp-server-0.0.0.jar log4j-jcl-2.17.2.jar geode-connectors-0.0.0.jar -jackson-core-2.18.6.jar +jackson-core-2.21.2.jar jetty-util-9.4.57.v20241219.jar log4j-slf4j-impl-2.17.2.jar lucene-analyzers-common-6.6.6.jar @@ -71,7 +71,7 @@ jaxb-impl-2.3.2.jar jna-platform-5.11.0.jar log4j-jul-2.17.2.jar HdrHistogram-2.1.12.jar -jackson-annotations-2.18.6.jar +jackson-annotations-2.21.jar micrometer-core-1.9.1.jar shiro-config-ogdl-1.13.0.jar geode-log4j-0.0.0.jar @@ -87,7 +87,7 @@ antlr-2.7.7.jar jetty-xml-9.4.57.v20241219.jar geode-rebalancer-0.0.0.jar jetty-server-9.4.57.v20241219.jar -jackson-datatype-jsr310-2.18.6.jar -jackson-datatype-joda-2.18.6.jar +jackson-datatype-jsr310-2.21.2.jar +jackson-datatype-joda-2.21.2.jar joda-time-2.10.14.jar byte-buddy-1.14.9.jar \ No newline at end of file diff --git a/pull-requests/GEODE-10576.md b/pull-requests/GEODE-10576.md new file mode 100644 index 000000000000..49d2a3b7543f --- /dev/null +++ b/pull-requests/GEODE-10576.md @@ -0,0 +1,63 @@ +# GEODE-10576: Remediation of security vulnerability (GHSA-2m67-wjpj-xhg9) + +**Base branch:** `support/1.15` + +## Summary + +Upgrade Jackson libraries from 2.17.0 to 2.21.2 to address a high-severity security vulnerability in `jackson-core`. + +- `jackson-core`, `jackson-databind`, `jackson-dataformat-yaml`, `jackson-datatype-joda`, `jackson-datatype-jsr310`: 2.17.0 → 2.21.2 +- `jackson-annotations`: 2.17.0 → 2.21 (aligned with upstream release versioning) + +## Security Vulnerability + +| Field | Value | +|---|---| +| Snyk ID | SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 | +| Type | Allocation of Resources Without Limits or Throttling (CWE-770) | +| Severity | 8.7 HIGH (CVSS v4.0) | +| Affected Package | com.fasterxml.jackson.core:jackson-core | +| Affected Versions | [2.8.0, 2.21.2) | +| Fixed Version | 2.21.2 | +| Disclosed | 4 Apr 2026 | +| Published | 5 Apr 2026 | + +### Description + +Affected versions of `jackson-core` are vulnerable to Allocation of Resources Without Limits or Throttling in the +enforcement of document length constraints in blocking, async, and DataInput +parser processes. An attacker can cause excessive resource consumption by submitting +oversized JSON documents that bypass configured size limits. + +### References + +- [GitHub Issue #1570](https://github.com/FasterXML/jackson-core/issues/1570) +- [Maintainer's Advisory (GHSA-2m67-wjpj-xhg9)](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-2m67-wjpj-xhg9) +- [Fix Commit 74c9ee2](https://github.com/FasterXML/jackson-core/commit/74c9ee255d1534c179bc7d3de48941bf39a9079c) +- [Fix Commit 7ce3622](https://github.com/FasterXML/jackson-core/commit/7ce3622f40e66bd821b5184d6055d8493afac5f3) + +## Changes + +| File | Description | +|---|---| +| DependencyConstraints.groovy | Updated jackson.version and jackson.databind.version to 2.21.2; added separate jackson.annotations.version set to 2.21 | +| GeodeJsonMapper.java | Replaced deprecated `ObjectMapper.setSerializationInclusion()` with `setDefaultPropertyInclusion()` | +| JQFilterVerificationDUnitTest.java | Replaced deprecated `JsonNode.fields()` with `properties().iterator()` | +| assembly_content.txt | Updated Jackson jar filenames to new versions | +| gfsh_dependency_classpath.txt | Updated Jackson jar filenames to new versions | +| dependency_classpath.txt | Updated Jackson jar filenames to new versions | +| expected-pom.xml | Updated Jackson dependency versions in BOM | + +## Testing + +- `build` — compiles successfully +- `test` — unit tests pass (7477 tests completed, 1 pre-existing failure unrelated to Jackson) + +### For all changes, please confirm: + +- [x] Is there a JIRA ticket associated with this PR? Is it referenced in the commit message? +- [x] Has your PR been rebased against the latest commit within the target branch (typically `support/1.15`)? +- [x] Is your initial contribution a single, squashed commit? +- [x] Does `gradlew build` run cleanly? +- [x] Have you written or updated unit tests to verify your changes? +- [x] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?