Enhancement: Upgrade Jackson to 2.12.6 or 2.13.1

[robelcik]

Description

Upgrade Jackson to 2.12.6, as currently used version contains known (possible) DoS vulnerability.

Expected Outcome

Jackson upgraded to the latest 2.12.x

Current Outcome

Currently used Jackson contains a known possible DoS vulnerability:
FasterXML/jackson-databind#3328
https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698

In December, I reported it to security@payara.fish but I have not got any reply.
In February, I added related post to forum.payara.fish but I have not got any reply.
That's why I'm submitting a request here.

Alternatives

Upgrade Jackson to the latest 2.13.x

[AlanRoth]

Hi @robelcik,

It appears we haven't received any emails for Jackson vulnerabilities to our security@payara.fish inbox in December, we apologise about that, we actively monitor and aim to investigate all security requests.

We are investigating the impact of the vulnerability that you have shared.

Thank you,
Alan

[AlanRoth]

Hi @robelcik,

The server itself should not be vulnerable as Jackson does not seem to be used to process any arbitrary user input - deployed applications may be affected.

I have raised FISH-6067 to keep track of the resolution of this issue.

Thank you,
Alan

[robelcik]

Thank you, @AlanRoth!

[robelcik]

Hello.
There are new findings in that area, which suggest using 2.13.x rather than 2.12.x.

• Optimize UntypedObjectDeserializer wrt recursion [CVE-2020-36518] FasterXML/jackson-databind#2816
• Optimize JsonNodeDeserialization wrt recursion FasterXML/jackson-databind#3397
• https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244

[AlvinYueChao]

2.13.x and 2.12.6 not work for the below issue
FasterXML/jackson-databind#2816

[AlanRoth]

Hi @robelcik,

We have upgraded Jackson to 2.12.6, it will be available in the next Community and Enterprise releases.

Thank you,
Alan

[robelcik]

Thank you, guys!

@JamesHillyard: As for now, 2.13.2 is the latest greatest.