Block more classes from polymorphic deserialization (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362)

[cowtowncoder]

This issue covers following CVEs related to polymorphic deserialization, gadgets:

CVE-2018-19360 (axis2-transport-jms)
CVE-2018-19361 (openjpa)
CVE-2018-19362 (jboss-common-core)

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Original vulnerability discoverer:
吴桂雄 Wuguixiong

Fixed in:

• 2.9.8 and later
• 2.8.11.3
• 2.7.9.5
• 2.6.7.3

[cowtowncoder]

Fix released on 23-Nov-2018, in:

• 2.7.9.5 (micro-patch of jackson-databind)
• 2.8.11.3 (micro-patch of jackson-databind, plus jackson-bom version 2.8.11.20181123)

and will be included in 2.9.8 as soon as that gets released (full release along with other fixes)

[bbossola]

Will this fix be included in 2.6.7.3, like #2097 was for 2.6.7.2?

[cowtowncoder]

@bbossola I don't think I will release any more 2.6.7.x micro-patches at this point, so no.

[sudhi-git]

Has the 2.9.8 version been released with the fixes?

[cowtowncoder]

Not yet. Should be released within next week or two, definitely before end of 2018.

[cowtowncoder]

@sudhi-git 2.9.8 released today, as per:

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8