STAC-25124 VEX Jackson databind CVE across Java images

[LouisLotter]

What changed

Adds image-scoped OpenVEX coverage for CVE-2026-54515 / GHSA-5jmj-h7xm-6q6v where the latest dev-chart cve-reporter run reports jackson-databind 2.22.0.

Covered product groups:

• StackGraph: hbase-master, hbase-regionserver, stackgraph-console, stackgraph-hbase, tephra-server
• StackState runtime: stackstate-correlate, stackstate-kafka-to-es, stackstate-receiver, stackstate-server
• docker-images Java runtimes: elasticsearch, hadoop, kafka, s3proxy, zookeeper

The coverage includes quay.io/stackstate/*, registry.rancher.com/suse-observability/*, and unqualified OCI PURLs, with pkg:maven/com.fasterxml.jackson.core/[email protected] as the subcomponent.

VEXHub requires each product PURL to live in a single file, so the statements are split by product ownership:

• pkg/oci/jackson-databind/scan.openvex.json covers StackGraph plus docker-images products.
• pkg/oci/sts-toolbox/scan.openvex.json adds the StackState runtime statement because those product PURLs already live in that file.

Why

A normal dependency fix is not currently possible. Maven Central still lists 2.22.0 as the newest published jackson-databind 2.x artifact, while the advisory fixed branches reported by scanners (2.18.9, 2.21.5, 2.22.1, 3.1.4) are not resolvable as of 2026-07-01.

Evidence

• The advisory requires a specific Jackson path: per-property @JsonIgnoreProperties exclusions combined with @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) or equivalent case-insensitive property deserialization.
• Source search across stackgraph, stackstate, docker-images, and the patched tinkerpop fork found no production path combining ignored properties with case-insensitive Jackson binding.
• Exact upstream source checks for docker-images dependencies found the same:
  • Kafka 3.9.2 and Hadoop 3.5.0 contain some @JsonIgnoreProperties use, but no Jackson JsonFormat / ACCEPT_CASE_INSENSITIVE_PROPERTIES use.
  • ZooKeeper 3.9.5 and S3Proxy commit 7925896cf3f6d48cee3c9de5ae80cd5a24ddbdab contain no matching Jackson annotation/configuration hits.
  • The Elasticsearch 8.19.16 modules containing the flagged jars have no matching Jackson annotation/configuration hits.
• HBase REST has unrelated ObjectMapper use, but SUSE Observability deploys StackGraph HBase master/regionserver/stackgraph-hbase images, not the HBase REST server.
• The statement remains image-scoped rather than package-scoped, so it does not over-claim every possible [email protected] consumer.

Validation

• python3 -m json.tool pkg/oci/jackson-databind/scan.openvex.json
• python3 -m json.tool pkg/oci/sts-toolbox/scan.openvex.json
• python3 tools/build_index.py
• python3 tools/build_index.py --check
• Coverage cross-check: the 14 image names reported for CVE-2026-54515 in cve-reporter run 28497520040 match the VEX product statements.