[GEODE-10627] Remediation of CVE-2026-19032 - #8056
Conversation
utafrali
left a comment
utafrali
left a comment
There was a problem hiding this comment.
The version bump from 2.21.5 to 2.21.6 is applied consistently across all five files for the four targeted Jackson artifacts. The blocking concern is that jackson-annotations is left at version "2.21" with no explanation, and the PR description provides no detail about what CVE-2026-19032 affects, making it impossible to verify the remediation is complete.
| deps.put("jboss-modules.version", "1.11.0.Final") | ||
| deps.put("jackson.version", "2.21.5") | ||
| deps.put("jackson.version", "2.21.6") | ||
| deps.put("jackson.annotations.version", "2.21") |
There was a problem hiding this comment.
jackson.annotations.version stays at "2.21" while jackson.version and jackson.databind.version both move to 2.21.6. The annotations module lives in the same com.fasterxml.jackson.core group as the two modules being patched. For a CVE remediation, it needs to be explicit whether CVE-2026-19032 does not affect jackson-annotations (in which case a comment here explains why this key is intentionally left behind), or whether jackson-annotations-2.21.6 has not been released (in which case a follow-up ticket should be created). As written, a reviewer cannot distinguish intentional scoping from an oversight.
There was a problem hiding this comment.
Could you please share where I can find jackson.annotations version 2.21.6 and how the CVE affects jackson.annotations?
| lib/jackson-databind-2.21.5.jar | ||
| lib/jackson-datatype-joda-2.21.5.jar | ||
| lib/jackson-datatype-jsr310-2.21.5.jar | ||
| lib/jackson-core-2.21.6.jar |
There was a problem hiding this comment.
The assembled distribution still ships jackson-annotations-2.21.jar while every sibling Jackson jar is now at 2.21.6. This is a direct consequence of the version constraint above. If this is intentional, no change is needed here, but the reason should be documented in the PR description or as a comment in DependencyConstraints.groovy so future maintainers understand the version skew.
| <groupId>com.fasterxml.jackson.core</groupId> | ||
| <artifactId>jackson-core</artifactId> | ||
| <version>2.21.5</version> | ||
| <version>2.21.6</version> |
There was a problem hiding this comment.
The PR description contains no information about what CVE-2026-19032 actually affects (e.g., deserialization in jackson-databind, parsing in jackson-core, etc.). Without that context, reviewers cannot confirm whether this four-artifact version bump is complete or whether additional Jackson modules (e.g., jackson-dataformat-yaml, which is also pinned via jackson.version) are also in scope. Please add a brief description of the vulnerability surface so the fix can be evaluated on its merits.
There was a problem hiding this comment.
Updated the description for the purpose of this PR. Thank you.
2 participants
Updated jackson.version and jackson.databind.version to remediate the CVE.
For all changes, please confirm:
develop)?gradlew buildrun cleanly?