Debian alert DLA-4623-1 (jackson-core)

From:
             
 
Markus Koschany <apo@debian.org>
To:
             
 
debian-lts-announce <debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 4623-1] jackson-core security update
Date:
             
 
Mon, 08 Jun 2026 13:55:59 +0200
Message-ID:
             
 
<6e40f821675f6f4751e18d78bfefb475961df629.camel@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4623-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Markus Koschany
June 08, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : jackson-core
Version        : 2.14.1-2~deb11u1
CVE ID         : CVE-2025-49128 CVE-2025-52999
Debian Bug     : 1108367

Two security vulnerabilities have been found in jackson-core, a fast and
powerful JSON library for Java, which may allow an attacker to cause a denial
of service by using deeply nested JSON data or disclose sensitive information
by abusing a flaw in how certain exception messages are handled in jackson-
core.

Please note that related and complementary jackson-* packages like jackson-
databind or the jackson-dataformat-* packages had to be upgraded as well in
order to fix build failures caused by the newer upstream release of jackson-
core.

For Debian 11 bullseye, these problems have been fixed in version
2.14.1-2~deb11u1.

We recommend that you upgrade your jackson-* packages.

For the detailed security status of jackson-core please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/jackson-core

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQKTBAABCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmomrc9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeRwig//Zb0PHyPKBJmWHO+gifNgQLYiFLfasvo6+E3+TTbpr1I9NjD7ueGOZnQ2
VRvq0IaEoC4VRZj8eWJtT7TSmibX8myXVFf1xcetiEwGGrZ/PY7SAp7GJSmDHMJq
0H/b/hEnlwrkYWrY1i6kGV/JyD0zvEVFHIsN2ruF+AH6HL1/yuhoemfE2Nqo8RAz
8vWnrogEx1o6Gv9Rtk2gfUc2dPnbeG5Ix52YrHij5SDbik6mRWTnHdeIhjcDs4/P
XZTme43RY05nhN+HCAyPA5saNp4WAYdVo/psNY4AFcbcCPXy0Sb/bTEbj+TfuaWy
hUIJE8/uwuDZ00Brl97LG3qgMmYGQe5dMCoXDjh4dDsg9DF0UMRoOoyHqlOloxB+
unM3+KCJrLNlX15JzLiHiIgqfEuLAj3BRJ3vtb1EXtxb6kcrKTQZRXuCpH9STU9H
zWldPPk6K279OFcTYbHXWiuM6A81hsSHcAxcgDAV241hhhikvda5U8XO2xeg32Ep
NcHqqTkJfXtrSSLq7qLfosW5c3c6ZgkuACIKklbAmFQWQaZMxm58WHCeOejwtXPX
nCH88MjV1kyeFTUFFbzg0tyPFKWwESFVQT09rfsRahYqddOczkLY4TdZ6d8FhLqo
ipd3bltwoZ3TgCOXVB9k6qn5Kr8oUc35If05bXOX4EzEJ8xi3gE=
=rxq7
-----END PGP SIGNATURE-----