Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in com.fasterxml.jackson.core:jackson-databind

Summary

jackson-databind's deserializer for `java.nio.file.Path` resolves an attacker-supplied URI without restricting the URI scheme. In `JDKFromStringDeserializer.NioPathHelper.deserialize`, a string bound from untrusted JSON is passed to `new URI(value)` and then to `Path.of(uri)`. When that throws `FileSystemNotFoundException`, the code enumerates `ServiceLoader<FileSystemProvider>` and calls `provider.getPath(uri)` on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered `FileSystemProvider` during `readValue` under a default `JsonMapper`, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party `FileSystemProvider` on the `classpath`. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding `java.nio.file.Path` from untrusted JSON should be avoided regardless of version.