| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.21.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.21.43.1.4 |
| tools.jackson.core:jackson-databind | ≥ 3.0.0, < 3.1.4 | 3.1.4 |
| jackson-databind | ≥ 2.21.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.21.43.1.4 |
POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter.
POJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.
git tag --contains)>= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport c3d56dd, #5968)>= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5967, e88cb17)Maintainer: minor. Reporter: HIGH. CWE-915.
Omkhar Arasaratnam (@omkhar) - finder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free