Skip to content

fix(security): upgrade Jackson to 2.22.3 #667

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 2 commits into from
Closed

fix(security): upgrade Jackson to 2.22.3 #667

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2b5eec2
fix(security): upgrade Jackson to 2.22.3
seonghobae Oct 1, 2026
b3279eb
docs(changelog): record Jackson CVE remediation
seonghobae Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@

### Security

- Jackson BOM과 직접 `jackson-databind` pin을 `2.22.3`으로 올려 `CVE-2026-91776`·`CVE-2026-91777`을 제거하고, `2.22.2`에서 수정된 `CVE-2026-68497`·`CVE-2026-19032`·`CVE-2026-83557`도 포함했습니다. clearfolio #323 exact head의 Security Scan `36932467956`/Trivy job `110604972561`이 공통 기반 RED 재현 증거입니다.

- `GET /api/v1/convert/jobs/{jobId}/download`가 리소스 조회 전에 전용 `artifact:read` 권한을 검증하고, PDF 저장소 접근 전에 작업의 tenant 소유권을 확인하도록 강화했습니다. `job:read`만으로는 문서 바이트를 읽을 수 없으며, 인증 누락·권한 누락·교차 tenant UUID 접근은 각각 fail closed 처리되고 교차 tenant 요청은 리소스 존재를 숨기는 `404`를 반환합니다.
- Maven XML 테스트 보고서 검증기는 각 `testsuite`의 `tests`, `skipped`, `failures`, `errors` 속성을 모두 필수 증거로 요구합니다. 누락된 결과 수를 암묵적으로 0으로 간주하지 않고 fail closed 처리하며, 각 속성 누락 회귀 테스트를 추가했습니다.
- Maven XML 테스트 보고서 검증기는 UTF-8만 허용하고 UTF-8 BOM은 수용하며, NUL 바이트·DTD·엔터티 선언을 파싱 전에 거부합니다. UTF-16 같은 대체 인코딩으로 위험 선언을 바이트 검사에서 숨기는 우회와 외부 엔터티 읽기·엔터티 확장형 서비스 거부를 회귀 테스트로 차단했습니다.
Expand Down
11 changes: 5 additions & 6 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,11 @@
which contains the July 2026 HTTP, HTTP/2, MQTT, compression, and
parser-boundary hardening release. -->
<netty.version>4.1.136.Final</netty.version>
<!-- Security override: pull the patched Jackson line for GHSA-5jmj-h7xm-6q6v
/ CVE-2026-54515 case-insensitive deserialization bypasses. The root
OSV config contains a narrow temporary ignore because OSV Scanner
v2.3.8 still reports 2.22.1 even though the advisory text names it as
patched. -->
<jackson-bom.version>2.22.1</jackson-bom.version>
<!-- Security override: Jackson 2.22.3 is the patched 2.22 line for
CVE-2026-91776 and CVE-2026-91777 and also retains the 2.22.2 fixes
for CVE-2026-68497, CVE-2026-19032, and CVE-2026-83557. Keep the
imported BOM and direct databind declaration on this single version. -->
<jackson-bom.version>2.22.3</jackson-bom.version>
<!-- Security override: GHSA-jhq6-gfmj-v8fx fixes logback-core in 1.5.35. -->
<logback.version>1.5.35</logback.version>
<!-- Security override: CVE-2025-68161 / CVE-2026-34477 / CVE-2026-34478 / CVE-2026-34480. -->
Expand Down
Loading