This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
UTF8DataInputJsonParser._reportInvalidToken()lacks maxErrorTokenLength limit, which allows for
unbounded StringBuilder growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).Changes for jackson-annotations:
Changes for jackson-bom:
Changes for jackson-core:
Changes for jackson-databind:
Changes for jackson-dataformat-xml:
Changes for jackson-dataformats-binary:
Strings not added to 'stringref' reference
table, breaking following referencesChanges for jackson-modules-base: