Conversation
The agent shipped jackson-databind 2.15.1 inside the third-party artifact za.co.absa.shaded:absa-shaded-jackson:0.0.1. That version is within the range affected by CVE-2026-54512 (CVSS 8.1, PolymorphicTypeValidator bypass via generic type parameters) and its siblings CVE-2026-54513..54518. Because the classes are relocated to za.co.absa.shaded.jackson, the host Spark cluster's own Jackson cannot override them - the agent carried its own vulnerable copy into every bundle from Spark 2.2 through 3.5. absa-shaded-jackson has only ever published 0.0.1, so there was no version to bump and no <jackson.version> property in this repo to change. This commit takes ownership of the Jackson version instead: agent-core now depends on vanilla Jackson and relocates it itself via maven-shade-plugin, using the za.co.absa.spline.shaded.* prefix already used for classgraph, fastparse and java-uuid-generator. Jackson is bumped 2.15.1 -> 2.18.10. Note that 2.19.x and 2.20.x are NOT patched for this CVE cluster; the fixes landed only in 2.18.8+, 2.21.4+ and 3.1.4. 2.18.10 is the newest of the patched 2.18 line, keeps the Java 8 baseline this project requires, and publishes both _2.11 and _2.12 artifacts. Changes: * core/pom.xml: replace absa-shaded-jackson / absa-shaded-jackson-module-scala with com.fasterxml.jackson.* behind a new <jackson.version> property, so any future CVE is a one-line change. * core/pom.xml: add maven-shade-plugin relocating com.fasterxml.jackson and com.thoughtworks.paranamer. combine.self="override" is required so the module does not inherit the bundle-oriented shade config from the parent pom. META-INF/versions/** is excluded because jackson-core 2.18 ships a multi-release overlay compiled to class file major version 65, which maven-shade-plugin 3.4.1 cannot read - it fails the core build and would fail all nine bundle builds that re-shade this jar. * HarvesterJsonSerDe.scala: imports back to vanilla com.fasterxml.jackson.*. Shading rewrites the bytecode at package time, so no behaviour changes. No bundle POM needed changing - all nine inherit the fix through agent-core. Verified on every bundle (Spark 2.2, 2.3, 2.4, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, across Scala 2.11 and 2.12): each jar carries the relocated Jackson at 2.18.10 and zero un-relocated jackson-databind/jackson-core classes. agent-core's dependency-reduced POM lists no com.fasterxml.jackson coordinate, so standalone --packages agent-core users cannot resolve vulnerable Jackson transitively either. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan includes up to 2 reviews per rolling hour; 1 remains after this review. WalkthroughThe core module now declares standard Jackson and Paranamer dependencies, shades and relocates them into the core JAR, and updates ChangesJackson shading migration
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The PR updates the bundled Jackson dependency to the patched version without any identified merge-blocking issue; no actionable risk remains beyond normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit packs jars with care, Comment |
|
2 participants
By default, Spline Spark Agent code repo shipped jackson-databind 2.15.1 inside the third-party artifact za.co.absa.shaded:absa-shaded-jackson:0.0.1. That version is within the range affected by CVE-2026-54512 (CVSS 8.1, PolymorphicTypeValidator bypass via generic type parameters) and its siblings CVE-2026-54513..54518.
Because the classes are relocated to za.co.absa.shaded.jackson, the host Spark cluster's own Jackson cannot override them - the agent carried its own vulnerable copy into every bundle from Spark 2.2 through 3.5.
absa-shaded-jackson has only ever published 0.0.1, so there was no version to bump and no <jackson.version> property in this repo to change. This commit takes ownership of the Jackson version instead: agent-core now depends on vanilla Jackson and relocates it itself via maven-shade-plugin, using the za.co.absa.spline.shaded.* prefix already used for classgraph, fastparse and java-uuid-generator.
Jackson is bumped 2.15.1 -> 2.18.10. Note that 2.19.x and 2.20.x are NOT patched for this CVE cluster; the fixes landed only in 2.18.8+, 2.21.4+ and 3.1.4. 2.18.10 is the newest of the patched 2.18 line, keeps the Java 8 baseline this project requires, and publishes both _2.11 and _2.12 artifacts.
Changes:
No bundle POM needed changing - all nine inherit the fix through agent-core.
Verified on every bundle (Spark 2.2, 2.3, 2.4, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, across Scala 2.11 and 2.12): each jar carries the relocated Jackson at 2.18.10 and zero un-relocated jackson-databind/jackson-core classes. agent-core's dependency-reduced POM lists no com.fasterxml.jackson coordinate, so standalone --packages agent-core users cannot resolve vulnerable Jackson transitively either.
Summary by CodeRabbit