Improve GHSA-r7wm-3cxj-wff9 - #8984
anthonydahanne wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the Jackson async-parser advisory with new CVE metadata and revised affected-version information.
Changes:
- Adds CVE-2026-68494 and its reference.
- Corrects the lower bound and parent CVSS score.
- Adds 2.22.x and 3.2.x ranges, though upstream evidence shows those releases already contain the fix.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
cd30fc0 to
fd7a673
Compare
fd7a673 to
1fedaa7
Compare
|
Hi @anthonydahanne, Thank you for update. Could you provide a link that shows the fixes in |
|
Hello @JonathanLEvans ! The fix for this advisory is #1611, and the release notes place it in 2.18.8, 2.21.4 and 3.1.4: VERSION-2.x#L188-L191 — 2.18.8 (28-May-2026) The 2.22 and 3.2 branches were cut after that, so they carry the fix from their first release — VERSION-2.x#L32-L35 records 2.22.0 (03-Jun-2026) as "No changes since 2.21", and VERSION#L40-L44 shows 3.2.0 (08-Jun-2026) with 3.2.1 as "No changes since 3.2.0". Verifiable directly against the fix commit: The commit merged 2026-05-21; jackson-core-2.22.0 was tagged 2026-06-03 and jackson-core-3.2.0 on 2026-06-08. The 2.22.2 / 3.2.2 entries you found are separate issues — #1630, #1642 (GHSA-2c4j-63jj-9fqr), #1643 (CVE-2026-68498) and #1649 — not #1611. So the current diff makes four changes only: sets aliases to ["CVE-2026-68494"]; raises the 2.x lower bound from 0 to 2.15.0 (maxNumberLength didn't exist before 2.15.0, so earlier releases have no constraint to bypass); corrects "The parent advisory was scored CVSS 8.7 High" to 6.9 Moderate; and adds the CVE record reference. The three existing affected ranges are unchanged. |
|
Hello GH curators 👋 |
|
👋 |
Note
The original submission text below is struck through — it was written before the
2.22.x/3.2.xranges were removed from the diff. See the corrected summarythat follows.
UpdatesAffected productsDescriptionReferencesCommentsAdding the CVE ID assigned by HeroDevs (CNA): CVE-2026-68494, published 2026-08-04. The CVE record cites this GHSA as its source advisory and links CVE-2026-18401 as the incomplete-fix parent.Three corrections to the affected-version data:The 2.22.x and 3.2.x lines appear to be missing. Per the upstream release notes the fix also shipped in 2.22.1 and 3.2.1, so >= 2.22.0, < 2.22.1 and >= 3.2.0, < 3.2.1 should be listed as affected. Users on those lines currently receive no alert.The 2.x range has no lower bound (introduced: 0). maxNumberLength was introduced in 2.15.0, so releases before that have no constraint to bypass. Note GHSA-72hv-8253-57qq's OSV export already uses introduced: 2.15.0.Minor factual error in the description: "The parent advisory was scored CVSS 8.7 High" — GHSA-72hv-8253-57qq is scored 6.9 Moderate. 8.7 is this advisory's score.Links GHSA-r7wm-3cxj-wff9 to its assigned CVE and corrects three details in the record.
Changes
aliases— set to["CVE-2026-68494"]. Assigned by HeroDevs (CNA), published 2026-08-04. The CVE record names this GHSA in itssource.advisoryfield. Without the alias, downstream consumers treat the GHSA and the CVE as two separate vulnerabilities.introduced: 0→2.15.0.StreamReadConstraintsand itsmaxNumberLengthsetting were introduced in jackson-core 2.15.0, so releases before that have no such constraint to bypass. GHSA-72hv-8253-57qq, the parent advisory, already usesintroduced: 2.15.0.CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N(6.9); 8.7 is this advisory's own score.The three existing affected ranges are unchanged:
2.15.0 → 2.18.8,2.19.0 → 2.21.4,3.0.0 → 3.1.4.Why 2.22.x and 3.2.x are not listed
An earlier revision of this PR added
>= 2.22.0, < 2.22.1and>= 3.2.0, < 3.2.1. That was wrong and both were removed — those lines were never affected.The fix for this advisory is FasterXML/jackson-core#1611, released in 2.18.8 and 2.21.4 (28-May-2026) and 3.1.4 (29-May-2026):
The 2.22 and 3.2 branches were cut afterwards, so they carry the fix from their first release. [VERSION-2.x#L32-L35](https://github.com/FasterXML/jackson-core/blob/648eb6e5289236f28092c50d5b39072390327bb9/release-notes/VERSION-2.x#L32-L35) records 2.22.0 (03-Jun-2026) as "No changes since 2.21", and [VERSION#L40-L44](https://github.com/FasterXML/jackson-core/blob/648eb6e5289236f28092c50d5b39072390327bb9/release-notes/VERSION#L40-L44) shows 3.2.0 (08-Jun-2026) with 3.2.1 as "No changes since 3.2.0".
Verifiable against the fix commit:
The commit merged 2026-05-21;
jackson-core-2.22.0was tagged 2026-06-03 andjackson-core-3.2.0on 2026-06-08.The unreleased
2.22.2/3.2.2entries in the release notes are separate issues — #1630, #1642 (GHSA-2c4j-63jj-9fqr), #1643 (CVE-2026-68498) and #1649 — not #1611.