fasterxml jackson-databind vulnerabilities and exploits

(subscribe to this query)

jackson-databind 2.10.x up to and including 2.12.x prior to 2.12.6 and 2.13.x prior to 2.13.1 allows malicious users to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Fasterxml Jackson-databind Fasterxml Jackson-databind 2.13.0

jackson-databind up to and including 2.15.2 allows malicious users to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps ...

Fasterxml Jackson-databind

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.x up to and including 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker...

Fasterxml Jackson-databind Debian Debian Linux 8.0

3 Github repositories

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.x prior to 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpa...

Fasterxml Jackson-databind Debian Debian Linux 8.0 Debian Debian Linux 9.0

4 Github repositories

A deserialization flaw exists in jackson-databind up to and including 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory,...

Fasterxml Jackson-databind Oracle Retail Merchandising System 15.0 Oracle Retail Sales Audit 14.1

A flaw exists in FasterXML jackson-databind in all versions prior to 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping(...

Fasterxml Jackson-databind Netapp Oncommand Api Services -Netapp Steelstore Cloud Integrated Storage -Oracle Goldengate Stream Analytics

In FasterXML jackson-databind prior to 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Fasterxml Jackson-databind Quarkus Quarkus Debian Debian Linux 10.0 Debian Debian Linux 11.0 Netapp Oncommand Workflow Automation -

6 Github repositories

In FasterXML jackson-databind prior to 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Fasterxml Jackson-databind Quarkus Quarkus Debian Debian Linux 10.0 Debian Debian Linux 11.0 Netapp Oncommand Workflow Automation -

4 Github repositories

FasterXML jackson-databind 2.x prior to 2.9.9.1 might allow malicious users to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Fasterxml Jackson-databind Debian Debian Linux 8.0 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 7.4 Redhat Enterprise Linux 7.5 Redhat Enterprise Linux 7.6 Redhat Enterprise Linux 7.7

4 Github repositories

FasterXML jackson-databind 2.x prior to 2.9.7 might allow malicious users to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Fasterxml Jackson-databind Fasterxml Jackson-databind 2.7.0 Fasterxml Jackson-databind 2.8.0 Fasterxml Jackson-databind 2.9.0 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Oracle Banking Platform 2.5.0 Oracle Banking Platform 2.6.0 Oracle Banking Platform 2.6.1 Oracle Banking Platform 2.6.2 Oracle Communications Billing And Revenue Management 7.5 Oracle Communications Billing And Revenue Management 12.0

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook