[GHSA-5gvw-p9qm-jgwh] jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

[levpachmanov]

Updates

• Affected products

Comments
The affected ranges for com.fasterxml.jackson.core:jackson-databind are too narrow.

The missing @JSONVIEW check in UnwrappedPropertyHandler.processUnwrapped() dates back
to JACKSON-608, which added JSON Views for deserialization (commits 5639f345 and
00d8158c, first released in 2.0.0-RC1). That change added the view check for regular
properties but not for @JsonUnwrapped ones, and the code stayed the same until the fix
in #6056. The fix shipped only in 2.18.9, 2.21.5 and 2.22.1, so 2.19.x and 2.20.x are
still vulnerable.

I ran the advisory's PoC against every 2.x release on Maven Central, with control
checks that view filtering works otherwise. Every version before 2.18.9 is vulnerable,
as is everything from 2.19.0 through 2.21.4. Jackson 1.x is not affected because it
only supports @JSONVIEW for serialization. The tools.jackson.core (3.x) ranges are
already correct.

Proposed changes:

• ">= 2.18.0, <= 2.18.8" -> ">= 2.0.0-RC1, < 2.18.9"
• ">= 2.21.0, < 2.21.5" -> ">= 2.19.0, < 2.21.5"

[github]

Hi there @cowtowncoder! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[advisory-database]

Hi @levpachmanov! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!