Jackson-core Async Parser Integer Length Validation Inconsistency Fix

Vulnerability Overview This vulnerability involves the application of the digit length validator within the streaming integer path of the asynchronous parser. The specific issue is that the integer path in the asynchronous non-blocking parser exits with logic inconsistent with the length validation logic, causing to be executed inconsistently between the synchronous and asynchronous parsers. Impact Scope Affected Versions: 2.18, 2.21, 2.22, 3.1, 3.2 Specific Impact: In the streaming integer path of the asynchronous parser, the digit length validation is not executed correctly, potentially leading to parsing errors or security vulnerabilities. Remediation 1. Code Modifications: - In the class, within the , , (note: likely a typo in original, refer to distinct methods), and methods, utilize the existing helper method to ensure consistency for . - A new test case, , has been added to verify streaming behavior under digit-only blocks for both integer and fractional paths. 2. Test Verification: - Run the to ensure all tests pass (1437 test cases, 0 failures, 0 errors, 2 skipped). 3. Merge and Release: - This fix has passed code review and been merged into the branch of the repository. - The fix has been released in the following versions: - 2.18 (for 2.18.8) - 2.21 (for 2.21.4) - 2.22 (for 2.22.0) - 3.1 (for 3.1.4) - 3.2 (for 3.2.0) POC Code Summary The vulnerability has been remediated by applying the digit length validator to the streaming integer path of the asynchronous parser, ensuring consistency of between synchronous and asynchronous parsers. The fix has been verified through testing and merged into multiple versions, ensuring system stability and security.

Goal Reached Thanks to every supporter — we hit 100%!

Jackson-core Async Parser Integer Length Validation Inconsistency Fix

More from this source