epugh opened a new pull request, #226: URL: https://github.com/apache/solr-site/pull/226
The `not_affected` statement for the 15 classic jackson-databind deserialization "gadget" CVEs (CVE-2017-15095 and 14 others) listed its range as `4.7.0-8.x`, but "all of 8.x" is too broad. These are all the **pre-block-list "individual gadget" era** CVEs (2017–early 2021). Their fix versions cluster at **≤ 2.9.10.7 / ≤ 2.10.5.1** — the latest, CVE-2021-20190, is fixed in **2.10.5.1**. Mapping onto the jackson-databind Solr actually shipped: | Solr | jackson-databind | in these CVEs' range? | |---|---|---| | 4.7.0 – 8.3.1 | 2.9.x (≤ 2.9.9.3) | yes | | 8.4.0 – 8.6.3 | 2.10.0 / 2.10.1 | yes (< 2.10.5.1) | | 8.7.0 – 8.9.x | 2.11.2 | no | | 8.10.0 – 8.11.1 | 2.12.3 | no | | 8.11.2 | 2.13.3 | no | | 9.x / 10.x | 2.13+ / 2.20 | no | So the standalone `jackson-databind` this statement covers is only within range through **8.6.3**; range corrected to **`4.7.0-8.6.3`**, with the body updated to explain the boundary. The separate old 2.x jackson-databind shaded inside `htrace-core4` (which spans the full 8.x line and was removed in 9.x) is unaffected by this change — it remains tracked under SOLR-17236, as the entry already notes. Disposition unchanged (`not_affected` — Solr enables no polymorphic/default typing). This only tightens the version metadata. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
