Skip to content

bug #16844 fix: le contrôle de conformité ne remonte qu'une anomalie à la fois - #114

Open
Regzox wants to merge 2 commits into
masterfrom
bug_16844
Open

bug #16844 fix: le contrôle de conformité ne remonte qu'une anomalie à la fois#114
Regzox wants to merge 2 commits into
masterfrom
bug_16844

Conversation

@Regzox

@Regzox Regzox commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

checkWithXSDSchema et checkWithRNGSchema n'installaient pas d'ErrorHandler sur le
Validator, qui lève donc sur la première anomalie rencontrée. Un manifest non
conforme ne remontait ainsi qu'une anomalie par contrôle, et il fallait rejouer le
contrôle autant de fois qu'il y avait de problèmes, chaque passage donnant une
image différente de la précédente. C'est le "un contrôle a remonté des anomalies,
les contrôles suivants n'en ont pas remonté" de la remontée utilisateur: le
contrôle ne décrit jamais l'état complet du paquet, seulement le premier écart
encore présent.

  • SEDAXMLValidator: un ErrorHandler collecte toutes les anomalies récupérables au
    lieu de laisser le validateur s'arrêter sur la première. Une erreur fatale reste
    arrêtante puisque le document ne peut plus être analysé, mais elle est collectée
    avant. Les anomalies sont restituées ensemble, chacune avec son contexte
    (ArchiveUnit, ligne, colonne, message brut), au plus cinquante détaillées.
  • Les avertissements ne sont pas comptés comme des anomalies de conformité.
  • Tests: deux ArchiveUnits invalides remontent bien deux anomalies et non une, et
    le même contrôle rejoué sur le même paquet donne exactement le même résultat,
    pour le schéma SEDA comme pour un profil RNG.

Le contrôle reste par ailleurs mutateur du paquet qu'il vérifie: il renumérote les
identifiants quand l'option de renumérotation avant export est active, réécrit les
métadonnées de gestion depuis le contexte d'export et régénère toutes les Uri à la
sérialisation. C'est l'autre voie par laquelle deux contrôles successifs peuvent
différer; elle demande le texte des anomalies d'origine pour être tranchée.

… par objet importé

doProgressLog terminait par un Thread.sleep(1) placé hors du test de niveau
de log, ce dernier étant fait à l'intérieur de doProgressLogWithoutInterruption.
L'attente s'exécutait donc à chaque appel, y compris quand le message était
filtré et n'était affiché nulle part.

Or ce doProgressLog est appelé au niveau OBJECTS dans les boucles chaudes de
l'import, alors que ImportThread règle le niveau à OBJECTS_GROUP en mode
normal: une attente par fichier extrait du zip, par DataObjectGroup, par
BinaryDataObject, par PhysicalDataObject et par ArchiveUnit. Sur un SIP de
50 000 AU et 50 000 binaires cela fait environ 200 000 attentes, soit 4 mn
sous Linux et jusqu'à 50 mn sous Windows où un sleep d'1ms dure réellement
15,6ms. Pendant tout ce temps les menus Traiter et Export restent grisés,
puisque setContextLoaded n'est appelé que depuis ImportThread.done(), d'où
l'impossibilité de vérifier la conformité SEDA, de vérifier la conformité à
un profil et d'exporter le SIP dans la demi-heure suivant l'ouverture.

- SEDALibProgressLogger: les trois Thread.sleep(1) sont remplacés par
  checkInterruption(), qui lève InterruptedException si le drapeau
  d'interruption est posé. La sémantique d'annulation est identique,
  Thread.sleep ne faisant rien d'autre sur interruption, mais le coût est nul.
- SEDALibProgressLoggerTest: non-régression sur la durée des appels filtrés
  (20 000 appels sous 2s, contre 23s avant correctif) et sur la propagation
  de l'annulation par doProgressLog et doProgressLogIfStep.

Ce correctif couvre les trois tickets ouverts sur le même symptôme: #16842 pour la
vérification de conformité au SEDA 2.1, #16843 pour la vérification de conformité
au profil RNG des AN et #16845 pour l'export du SIP.
…à la fois

checkWithXSDSchema et checkWithRNGSchema n'installaient pas d'ErrorHandler sur le
Validator, qui lève donc sur la première anomalie rencontrée. Un manifest non
conforme ne remontait ainsi qu'une anomalie par contrôle, et il fallait rejouer le
contrôle autant de fois qu'il y avait de problèmes, chaque passage donnant une
image différente de la précédente. C'est le "un contrôle a remonté des anomalies,
les contrôles suivants n'en ont pas remonté" de la remontée utilisateur: le
contrôle ne décrit jamais l'état complet du paquet, seulement le premier écart
encore présent.

- SEDAXMLValidator: un ErrorHandler collecte toutes les anomalies récupérables au
  lieu de laisser le validateur s'arrêter sur la première. Une erreur fatale reste
  arrêtante puisque le document ne peut plus être analysé, mais elle est collectée
  avant. Les anomalies sont restituées ensemble, chacune avec son contexte
  (ArchiveUnit, ligne, colonne, message brut), au plus cinquante détaillées.
- Les avertissements ne sont pas comptés comme des anomalies de conformité.
- Tests: deux ArchiveUnits invalides remontent bien deux anomalies et non une, et
  le même contrôle rejoué sur le même paquet donne exactement le même résultat,
  pour le schéma SEDA comme pour un profil RNG.

Le contrôle reste par ailleurs mutateur du paquet qu'il vérifie: il renumérote les
identifiants quand l'option de renumérotation avant export est active, réécrit les
métadonnées de gestion depuis le contexte d'export et régénère toutes les Uri à la
sérialisation. C'est l'autre voie par laquelle deux contrôles successifs peuvent
différer; elle demande le texte des anomalies d'origine pour être tranchée.
@Regzox Regzox self-assigned this Sep 10, 2026
@Regzox Regzox added the bug Something isn't working label Sep 10, 2026
@vitam-prg

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Detailsaf7e931e-dd30-4d72-9a48-99eb93543152


New Issues (55) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL CVE-2026-59650 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 CRITICAL CVE-2026-8763 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 HIGH CVE-2026-12185 Maven-org.bouncycastle:bcprov-jdk15on-1.68
detailsRecommended version: 1.69.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 HIGH CVE-2026-12802 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for J...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 HIGH CVE-2026-12803 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, "KCCMBlockCipher" MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also a...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 HIGH CVE-2026-12816 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 HIGH CVE-2026-12860 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castl...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 HIGH CVE-2026-13006 Maven-ch.qos.logback:logback-core-1.5.18
detailsRecommended version: 1.5.37
Description: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core through version 1.5.36 allows an attacker to execute arbitrar...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
9 HIGH CVE-2026-13506 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
10 HIGH CVE-2026-14682 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
11 HIGH CVE-2026-18401 Maven-com.fasterxml.jackson.core:jackson-core-2.18.3
detailsRecommended version: 2.18.6
Description: The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadCon...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
12 HIGH CVE-2026-18401 Maven-com.fasterxml.jackson.core:jackson-core-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadCon...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
13 HIGH CVE-2026-54512 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.4
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 prior to 2.18.8, 2....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
14 HIGH CVE-2026-54512 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.6.redhat-00001
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 prior to 2.18.8, 2....
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
15 HIGH CVE-2026-54513 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.10.0 prior to 2.1...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
16 HIGH CVE-2026-54513 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.10.0 prior to 2.1...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
17 HIGH CVE-2026-58059 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
18 HIGH CVE-2026-58060 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy C...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
19 HIGH CVE-2026-58061 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
20 HIGH CVE-2026-59639 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CMS `verifySignatures` returns true for `SignedData` with zero signers. This issue also affects Bouncy Cas...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
21 HIGH CVE-2026-59642 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CMS AuthenticatedData content is not bound to the MAC when authAttrs are present. This issue also affects ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
22 HIGH CVE-2026-59644 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
23 HIGH CVE-2026-59645 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bo...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
24 HIGH CVE-2026-59651 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle f...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
25 HIGH CVE-2026-75140 Maven-org.jsoup:jsoup-1.21.1
detailsRecommended version: 1.23.2
Description: jsoup versions through 1.23.1, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in `XmlTreeBuilder` that allows...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
26 HIGH Cx2c9af752-2171 Maven-com.fasterxml.jackson.core:jackson-core-2.18.3
detailsRecommended version: 2.18.8
Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
27 HIGH Cx2c9af752-2171 Maven-com.fasterxml.jackson.core:jackson-core-2.20.0
detailsRecommended version: 2.21.4
Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
28 MEDIUM CVE-2026-0636 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.84
Description: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpr...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
29 MEDIUM CVE-2026-13586 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Ja...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
30 MEDIUM CVE-2026-15055 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
31 MEDIUM CVE-2026-19032 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.10
Description: jackson-databind's deserializer for `java.nio.file.Path` resolves an attacker-supplied URI without restricting the URI scheme. In `JDKFromStringDes...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
32 MEDIUM CVE-2026-19032 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.6
Description: jackson-databind's deserializer for `java.nio.file.Path` resolves an attacker-supplied URI without restricting the URI scheme. In `JDKFromStringDes...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
33 MEDIUM CVE-2026-19880 Maven-ch.qos.logback:logback-classic-1.5.19
detailsRecommended version: 1.6.3
Description: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
34 MEDIUM CVE-2026-19880 Maven-ch.qos.logback:logback-classic-1.5.18
detailsRecommended version: 1.6.3
Description: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
35 MEDIUM CVE-2026-28208 Maven-com.github.junrar:junrar-7.5.5
detailsRecommended version: 7.5.8
Description: Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allow...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
36 MEDIUM CVE-2026-28208 Maven-com.github.junrar:junrar-7.5.4
detailsRecommended version: 7.5.8
Description: Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allow...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
37 MEDIUM CVE-2026-49844 Maven-org.apache.logging.log4j:log4j-api-2.21.1
detailsRecommended version: 2.22.1.redhat-00002
Description: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
38 MEDIUM CVE-2026-49844 Maven-org.apache.logging.log4j:log4j-api-2.24.3
detailsRecommended version: 2.25.1.redhat-00001
Description: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JS...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
39 MEDIUM CVE-2026-54514 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.0.0 prior to 2.18...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
40 MEDIUM CVE-2026-54514 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.0.0 prior to 2.18...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
41 MEDIUM CVE-2026-54515 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 prior to 2.18.9, 2.1...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
42 MEDIUM CVE-2026-54515 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 prior to 2.18.9, 2.1...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
43 MEDIUM CVE-2026-5588 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
44 MEDIUM CVE-2026-58063 Maven-org.bouncycastle:bcprov-jdk18on-1.81
detailsRecommended version: 1.82.0.redhat-00001
Description: In Bouncy Castle for Java prior to 1.85, BCFKS keystore load honours unbounded KDF cost from an untrusted file. This issue also affects Bouncy Cast...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
45 MEDIUM CVE-2026-59647 Maven-org.bouncycastle:bcpkix-jdk18on-1.81.1
detailsRecommended version: 1.85
Description: In Bouncy Castle for Java prior to 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LT...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
46 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.8
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
47 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.4
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
48 MEDIUM CVE-2026-59889 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
49 MEDIUM CVE-2026-71497 Maven-org.jsoup:jsoup-1.21.1
detailsRecommended version: 1.23.1
Description: jsoup is a Java library for working with real-world HTML. From 1.14.3 prior to 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
50 MEDIUM CVE-2026-77310 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.9
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.x prior to versions 2....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
51 MEDIUM CVE-2026-77310 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.21.5
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.x prior to versions 2....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
52 MEDIUM CVE-2026-83557 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.3
detailsRecommended version: 2.18.4.redhat-00002
Description: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configu...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
53 MEDIUM CVE-2026-83557 Maven-com.fasterxml.jackson.core:jackson-databind-2.20.0
detailsRecommended version: 2.20.2.redhat-00003
Description: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configu...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
54 LOW CVE-2026-10532 Maven-ch.qos.logback:logback-core-1.5.18
detailsRecommended version: 1.5.34
Description: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Objec...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
55 LOW CVE-2026-9828 Maven-ch.qos.logback:logback-core-1.5.18
detailsRecommended version: 1.5.33
Description: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Objec...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package

Fixed Issues (2) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.18.3
HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.20.0

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants