Fedora alert FEDORA-2019-fb23eccc03 (jackson-bom)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 29 Update: jackson-bom-2.9.9-1.fc29 | |
| Date: | Sun, 22 Sep 2019 03:20:24 +0000 (UTC) | |
| Message-ID: | <20190922032024.0D4A66058533@bastion01.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2019-fb23eccc03 2019-09-22 03:19:44.980980 -------------------------------------------------------------------------------- Name : jackson-bom Product : Fedora 29 Version : 2.9.9 Release : 1.fc29 URL : https://github.com/FasterXML/jackson-bom Summary : Bill of materials POM for Jackson projects Description : A "bill of materials" POM for Jackson dependencies. -------------------------------------------------------------------------------- Update Information: - Update jackson-databind to version 2.9.9.3. - Update jackson-core to version 2.9.9. - Update jackson-annotations to version 2.9.9. - Update jackson-bom to version 2.9.9. Resolves CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, and CVE-14439. -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 12 2019 Alexander Scheel <ascheel@redhat.com> - 2.9.9-1 - Update to latest upstream release * Wed Feb 6 2019 Mat Booth <mat.booth@redhat.com> - 2.9.8-1 - Update to latest upstream release * Fri Feb 1 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #1737518 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1737518 [ 2 ] Bug #1725808 - CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1725808 [ 3 ] Bug #1725796 - CVE-2019-12814 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1725796 [ 4 ] Bug #1713469 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1713469 [ 5 ] Bug #1752964 - CVE-2019-14439 jackson-databind: Polymorphic typing issue related to logback/JNDI [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1752964 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-fb23eccc03' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann...