Skip to content

UID2-7557: suppress jackson-core GHSA-r7wm-3cxj-wff9 (async parser, not reachable) #2662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mcollins-ttd merged 2 commits into from
Jul 23, 2026
Merged

UID2-7557: suppress jackson-core GHSA-r7wm-3cxj-wff9 (async parser, not reachable) #2662

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d9b05ff
UID2-7557: suppress jackson-core GHSA-r7wm-3cxj-wff9 (async parser, n…
mcollins-ttd Jul 23, 2026
342115b
UID2-7279: drop stale CVE-2026-45447 .trivyignore entry (expired 2026…
mcollins-ttd Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,6 @@ CVE-2026-22184 exp:2026-09-09
# Availability only (C:N/I:N/A:H). Tracking via UID2-7035; revisit on vert.x 5 migration.
CVE-2026-42577 exp:2026-09-11

# CVE-2026-45447 — libcrypto3 PKCS#7/S/MIME memory corruption in Alpine base image.
# uid2-operator is a pure Java service; the JVM uses JSSE for TLS, not the native
# libcrypto3 C library. No JNI or OpenSSL calls in source. Attack vector (malformed
# PKCS#7/S/MIME parsing) is not reachable from this service. See: UID2-7279
CVE-2026-45447 exp:2026-07-11

# jackson-databind data-binding vulnerability - no upstream fix released yet (fix targets: 2.18.8, 2.21.4, 3.1.4)
# jackson-databind is pulled in transitively via uid2-shared; the version fix is tracked in
# uid2-shared (https://github.com/IABTechLab/uid2-shared/pull/631) and will flow here on the
Expand All @@ -62,3 +56,9 @@ CVE-2026-2100 exp:2026-09-01
CVE-2026-56131 exp:2026-08-09
CVE-2026-56407 exp:2026-08-09
CVE-2026-56408 exp:2026-08-09

# jackson-core async parser maxNumberLength bypass (GHSA-r7wm-3cxj-wff9) - incomplete fix for
# GHSA-72hv-8253-57qq. Not exploitable: services only use the synchronous ObjectMapper API, not
# jackson-core's non-blocking/async parser. A jackson bump is also in flight via uid2-shared
# (PR #631) and will flow on the next release. See: UID2-7557 (predecessor UID2-6670)
GHSA-r7wm-3cxj-wff9 exp:2026-08-23