Amazon Linux 2023 : jackson-databind (ALAS2023-2026-1947)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-1947.
##

include('compat.inc');

if (description)
{
  script_id(328466);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id(
    "CVE-2026-54512",
    "CVE-2026-54513",
    "CVE-2026-54514",
    "CVE-2026-54515"
  );

  script_name(english:"Amazon Linux 2023 : jackson-databind (ALAS2023-2026-1947)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1947 advisory.

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data
    Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV)
    is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled
    and a type identifier contains generic parameters (i.e. the type ID string contains <),
    DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring
    before <) against the configured PTV. If the container type is approved, the method parses the full
    canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type
    without ever validating the nested type arguments against the PTV. The nested type arguments are then
    resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type
    ID can therefore place a denied class as a generic type parameter of an allowed container -- for example
    java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes
    the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its
    properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV
    allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54512)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data
    Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4,
    BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on
    clazz.isArray(), without validating the array's component (element) type against the configured allowlist.
    A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits
    EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-
    element type IDs are present, it instantiates the component type directly with no further PTV check,
    bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54513)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data
    Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed
    InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for
    hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing
    an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-
    level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring
    DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54514)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data
    Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-
    property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual
    deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-
    insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from
    this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites
    the filtered map -- restoring every property _handleByNameInclusion had just removed. The ignored property
    becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4. (CVE-2026-54515)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-1947.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-54512.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-54513.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-54514.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-54515.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update jackson-databind --releasever 2023.12.20260720' or
  or 'dnf update --advisory ALAS2023-2026-1947 --releasever 2023.12.20260720' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-54513");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:jackson-databind");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'jackson-databind-2.16.1-4.amzn2023.0.2', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "jackson-databind");
}