Summary
kafka-access-operator:0.3.0 ships jackson-databind:2.18.3, which is affected by two critical vulnerabilities. Unlike the jetty issue in #141, this one is not fixed on main either — main pins the same fabric8 version, so a 0.4.0 release would ship the same vulnerable jackson.
Vulnerability details
1. Incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()
- CVSS v4.0 9.2 Critical (Snyk) / v3.1 8.1 High
- Snyk ID:
SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366
- The method allowlists an array based only on
clazz.isArray() without validating the array's component type, so an attacker controlling the deserialized JSON can instantiate types outside the configured allowlist by wrapping them in an array.
2. Deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric()
- CVSS v4.0 9.2 Critical (Snyk) / v3.1 8.1 High
- Snyk ID:
SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598
- Only the raw container class of a type identifier is validated against the configured
PolymorphicTypeValidator, not its nested generic type arguments. A denied class embedded as a generic parameter of an allowlisted container (e.g. java.util.ArrayList<com.evil.Gadget>) passes validation while the nested type is loaded and instantiated.
Both are fixed in jackson-databind 2.18.8 and 2.21.4.
Where it comes from
jackson is not declared anywhere in this project's poms. It arrives transitively:
kafka-access-operator -> fabric8.version 7.2.0 -> jackson-bom 2.18.3
io.fabric8:kubernetes-client-project:7.2.0 sets <jackson.version>2.18.3</jackson.version> and imports jackson-bom at that version.
Current state
Checked both the 0.3.0 tag and main — each pins <fabric8.version>7.2.0</fabric8.version>, and neither declares a jackson version. So the next release will carry the same two criticals unless fabric8 is bumped or jackson is pinned explicitly.
Suggested fix
Bumping fabric8 looks like the cleaner option, but the target version matters:
| fabric8 |
jackson |
| 7.2.0 (current) |
2.18.3 |
| 7.4.1 |
2.19.4 |
| 7.6.1 |
2.20.0 |
| 7.8.0 (latest) |
2.21.4 |
Snyk lists fixed versions as only 2.18.8 and 2.21.4, which suggests the fix was backported to the 2.18 line and fixed forward in 2.21, leaving 2.19.x and 2.20.x unpatched. If that reading is right, fabric8 >= 7.8.0 is the first release that actually clears both — worth confirming against the advisories rather than taking my word for it.
Alternatively, pinning jackson-bom to >= 2.18.8 in dependencyManagement would fix it without moving fabric8, though that leaves jackson and fabric8 on divergent lines.
References
Summary
kafka-access-operator:0.3.0shipsjackson-databind:2.18.3, which is affected by two critical vulnerabilities. Unlike the jetty issue in #141, this one is not fixed onmaineither —mainpins the same fabric8 version, so a 0.4.0 release would ship the same vulnerable jackson.Vulnerability details
1. Incomplete list of disallowed inputs in
BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440366clazz.isArray()without validating the array's component type, so an attacker controlling the deserialized JSON can instantiate types outside the configured allowlist by wrapping them in an array.2. Deserialization of untrusted data in
DatabindContext._resolveAndValidateGeneric()SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598PolymorphicTypeValidator, not its nested generic type arguments. A denied class embedded as a generic parameter of an allowlisted container (e.g.java.util.ArrayList<com.evil.Gadget>) passes validation while the nested type is loaded and instantiated.Both are fixed in
jackson-databind2.18.8 and 2.21.4.Where it comes from
jacksonis not declared anywhere in this project's poms. It arrives transitively:io.fabric8:kubernetes-client-project:7.2.0sets<jackson.version>2.18.3</jackson.version>and importsjackson-bomat that version.Current state
Checked both the
0.3.0tag andmain— each pins<fabric8.version>7.2.0</fabric8.version>, and neither declares a jackson version. So the next release will carry the same two criticals unless fabric8 is bumped or jackson is pinned explicitly.Suggested fix
Bumping fabric8 looks like the cleaner option, but the target version matters:
Snyk lists fixed versions as only
2.18.8and2.21.4, which suggests the fix was backported to the 2.18 line and fixed forward in 2.21, leaving 2.19.x and 2.20.x unpatched. If that reading is right, fabric8 >= 7.8.0 is the first release that actually clears both — worth confirming against the advisories rather than taking my word for it.Alternatively, pinning
jackson-bomto>= 2.18.8independencyManagementwould fix it without moving fabric8, though that leaves jackson and fabric8 on divergent lines.References