NES for Hazelcast 5.3.x Release Notes

Security Fixes

• A member that cannot run SQL (Jet disabled, or no hazelcast-sql module on the classpath) now rejects a client SQL request before it deserializes the request's parameters. This is a partial fix for GHSA-jcpf-8phq-8mmj. The SQL class-filter checks are in the hazelcast-sql module, which is not part of this release.
• ClientExceptionFactory can no longer instantiate an arbitrary non-Throwable class named by an unregistered protocol error (GHSA-rmqf-mh9c-3gr4).
• DefaultReflectiveAttributeLookupPolicy can no longer traverse Jet Traverser, Jackson Databind introspection, or Spring Beans classes through Predicate API attribute paths (GHSA-74r8-7r86-phxq). Blocking Traverser also prevents an authenticated client from reading arbitrary files on a member through Jet, even when Jet is disabled (GHSA-6hfv-j8jg-ggpx). Zero-config compact serialization also refuses Spring Beans, log4j and the JDBC-URL DataSource class by default.
• JobConfig custom classpath entries and FileSinkBuilder.rollByDate patterns can no longer resolve paths outside their configured directories (GHSA-jpwr-2cr3-32fm).
• SerializationClassNameFilter no longer allows known H2, Spring Beans, and Jackson Databind gadget classes by default when no Java serialization filter is configured (GHSA-m4hm-fvgc-9qpm).

Dependency Upgrades

• Jackson Annotations (NES) 2.15.4-jackson-annotations-2.15.10
• Jackson BOM (NES) 2.15.4-jackson-bom-2.15.10
• Jackson Core (NES) 2.15.4-jackson-core-2.15.10
• Jackson Databind (NES) 2.15.4-jackson-databind-2.15.10

Security Fixes

• Arbitrary member memory access by low-privileged client (GHSA-6v25-8wq6-xq4j, critical)
• Authorization bypass in IMap Predicates API (GHSA-w294-6q5q-53p8, high)

Dependency Updates

• Bundled (shaded) Jackson rebuilt on Jackson (NES) 2.15.4-jackson-bom-2.15.7

Dependency Updates

• Bundled (shaded) Jackson rebuilt on Jackson (NES) 2.15.4-jackson-bom-2.15.6, which includes the jackson-core fix for GHSA-72hv-8253-57qq (Number Length Constraint Bypass in Async Parser)