Jackson Work in Progress

Jackson WIP

This page is a "living document" of on-going work, mostly by @cowtowncoder (Tatu), although other committers are welcome to update it as well.

Last update

29-Oct-2018.

Urgent things

DoS vectors via BigDecimal, BigInteger

Group of issues related to possible Denial-of-Service attacks, making use of surprisingly poor performance characteristics of coercing from BigInteger into long, and thereby also BigDecimal (as it is based on 2 BigIntegers). Mostly implemented by 29-Oct-2018, to be included in 2.9.8

• https://github.com/FasterXML/jackson-core/issues/488 -- low-level early-fail on coercion of BigInteger into int, long, float, double
• https://github.com/FasterXML/jackson-databind/issues/2157 -- tests for coercion of huge BigDecimal into Enum (basically verifying streaming API's early fail)
• https://github.com/FasterXML/jackson-modules-java8/issues/90 -- specific issue wrt BigDecimal, Instant deserializer

New CVEs for Polymorphic Deserialization gadgets

• On 29-Oct-2018, 3 more gadgets were reported. More information will sent to jackson-dev-infosec list; fixes for 2.9.8 and 2.8.11.3