| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.15.0, < 2.18.8≥ 2.19.0, < 2.21.4 | 2.18.82.21.4 |
| tools.jackson.core:jackson-databind | ≥ 3.0.0, < 3.1.4 | 3.1.4 |
For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
git tag --contains)>= 2.15.0, < 2.18.8 -> fixed in 2.18.8 (backport c7c6783)>= 2.19.0, < 2.21.4 -> fixed in 2.21.4>= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5974, baa2cdf)Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Omkhar Arasaratnam (@omkhar) - finder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free