Which version of jackson-databind does not have remote execution vulnerability? - jackson

Question

I am unable to find online which version of jackson-databind to use with Spring application that doesn't have remote execution vulnerability? Any help is appreciated.

Answer 1

Since version 2.10.0 this problem is resolved by adding new set of methods: activateDefaultTyping instead of deprecated set of methods enableDefaultTyping. Also this problem was one of reasons to why this version was released.
Major Goals for 2.10
Looking back, there were 3 major goals for this minor release:
Resolve the growing problem of “endless CVE patches”, a
stream of fixes for reported CVEs related to “Polymorphic
Deserialization” problem (described in “On Jackson CVEs… ”) that
resulted in security tools forcing Jackson upgrades. 2.10 now includes
“Safe Default Typing” that is hoped to resolve this problem.
More you can find in this article: Jackson 2.10 features.
Example code:
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializationFeature;
import com.fasterxml.jackson.databind.json.JsonMapper;
import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
import java.util.ArrayList;
public class JsonPathApp {
public static void main(String[] args) throws Exception {
PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
.allowIfSubType(MyValue.class)
.allowIfSubType(ArrayList.class)
.build();
ObjectMapper mapper = JsonMapper.builder()
.enable(SerializationFeature.INDENT_OUTPUT)
.activateDefaultTyping(ptv, ObjectMapper.DefaultTyping.NON_FINAL).build();
}
}