From b66311dfa6701125103e8f5b3a273b4fd61a1e3b Mon Sep 17 00:00:00 2001
From: agrasth <agrasthn@jfrog.com>
Date: Sat, 15 Aug 2026 13:57:50 +0530
Subject: [PATCH] Patch CVE-2026-54512 / CVE-2026-54513 / CVE-2024-47554 in
 bundled deps

Bump the compile-scope Jackson stack to 2.18.8 (jackson-core,
jackson-databind, jackson-annotations) to close both PolymorphicTypeValidator
bypass CVEs flagged by Atlassian Ecoscanner:

  - jackson-databind@2.17.2 -> CVE-2026-54512 (GHSA-j3rv-43j4-c7qm)
    PolymorphicTypeValidator bypass via generic type parameters
  - jackson-databind@2.17.2 -> CVE-2026-54513 (GHSA-rmj7-2vxq-3g9f)
    array subtype allowlist bypass in BasicPolymorphicTypeValidator
    Both fixed in jackson-databind 2.18.8.

Also pin jackson-annotations at 2.18.8; the transitive 2.14.1 was
version-skewed against the 2.17.2 core/databind.

For CVE-2024-47554 (Apache Commons IO XmlStreamReader DoS), the
vulnerable commons-io 2.11.0 came in transitively through build-info-*.
Bamboo 9.6.x ships commons-io 2.15.1 (post-fix) in the runtime
classpath, and AMPS's banned-dependencies enforcer bans commons-io
from plugin bundles for exactly this reason. Excluding it from the
build-info-* transitive graph so the runtime version is used.

Version bumped to 1.0.5.2. mvn clean test: 9/9 passing.
---
 pom.xml | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index d6ae6fe..50bfc75 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.jfrog.bamboo</groupId>
     <artifactId>bamboo-jfrog-plugin</artifactId>
-    <version>1.0.5.1</version>
+    <version>1.0.5.2</version>
 
     <organization>
         <name>JFrog Ltd</name>
@@ -102,21 +102,45 @@
             <groupId>org.jfrog.buildinfo</groupId>
             <artifactId>build-info-extractor</artifactId>
             <version>${buildinfo.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.jfrog.buildinfo</groupId>
             <artifactId>build-info-api</artifactId>
             <version>${buildinfo.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.jfrog.buildinfo</groupId>
             <artifactId>build-info-client</artifactId>
             <version>${buildinfo.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.jfrog.filespecs</groupId>
             <artifactId>file-specs-java</artifactId>
             <version>1.1.2</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.jfrog.artifactory.client</groupId>
@@ -152,12 +176,17 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.17.2</version>
+            <version>2.18.8</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.17.2</version>
+            <version>2.18.8</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+            <version>2.18.8</version>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>