SOLR-18333: Split bundled 2026 jackson-databind VEX entry into per-CVE files with accurate ranges - #227
Merged
Merged
Conversation
… accurate ranges The single 2026-50193 entry bundled six issues under one range (4.7.0-10.0.0) and one justification, but they have genuinely different affected-version ranges and rationales. Split into one file per CVE, each scoped to the Solr releases whose own standalone jackson-databind is actually in that CVE's range (so the generator emits only in-range purls): - CVE-2026-54514 (SSRF) -> 9.0.0-9.10.1, 10.0.0 (code_not_reachable) - CVE-2026-54515 (case-insensitive)-> 9.0.0-9.10.1, 10.0.0 (requires_configuration) - CVE-2026-50193 (toString DoS) -> 9.0.0-9.1.1 (code_not_reachable) - CVE-2026-59888 (Record JsonIgnore)-> 9.3.0-9.10.1, 10.0.0 (requires_configuration) - CVE-2026-59889 (JsonView) -> 9.8.0-9.10.1 (requires_configuration) - GHSA-mhm7-754m-9p8w (ext-type-id)-> 9.8.0-9.10.1 (requires_configuration) Disposition stays not_affected. The prior entry also mis-stated that the SSRF did not affect Solr's own jackson-databind; it does (2.18.0 in 9.x, 2.20.0 in 10.0.0), only patched in 9.11 (2.22.0) - now corrected. The hadoop-client-runtime shaded 2.12.7.1 copy cannot be emitted by the generator (same shaded-purl gap as SOLR-17900) and is noted as a separate follow-up in each body. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
|
Having multiple CVE's in a single file may end up being a "vex smell"... As the versions are all different.. |
epugh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The single
2026-07-31-cve-2026-50193.mdentry bundled six jackson-databind issues under one range (4.7.0-10.0.0), one jar, and onecode_not_reachablejustification. But they have genuinely different affected-version ranges (and different rationales), so a single range/jar/justification can't represent them accurately.Split into one file per CVE, each scoped to exactly the Solr releases whose own standalone jackson-databind is in that CVE's affected range, so the generator emits only in-range product purls:
9.0.0-9.10.1, 10.0.0InetSocketAddress@JsonIgnoreProperties)9.0.0-9.10.1, 10.0.0toStringDoS)9.0.0-9.1.1@JsonIgnore)9.3.0-9.10.1, 10.0.0@JsonView/@JsonUnwrapped)9.8.0-9.10.19.8.0-9.10.1Disposition stays
not_affectedthroughout. Key corrections vs. the old entry:…-10.0.0bound emitted purls for versions that aren't affected at all.vexctl mergepasses.The
hadoop-client-runtime-shaded2.12.7.1copy is below the fix for the DoS/SSRF but its shaded purl can't be emitted by the generator today (same shaded-purl limitation as the SOLR-17900 avro/dnsjava/nimbus follow-up); each body notes this as a separate item.