Lucene search

K
atlassianSecurity-metrics-botCWD-6261
HistoryApr 09, 2024 - 1:54 a.m.

DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server

2024-04-0901:54:04
security-metrics-bot
jira.atlassian.com
7
denial of service
vulnerability
crowd data center
server
upgrade
fixed versions
atlassian
dependency
cvss score 7.5
unwrap_single_value_arrays

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

High

EPSS

0.003

Percentile

65.3%

This High severity com.fasterxml.jackson.core:jackson-databind Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.3 of Crowd Data Center and Server.

This com.fasterxml.jackson.core:jackson-databind Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction.

Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

||Affected versions||Fixed versions||
|5.2.0 to 5.2.3|5.2.4|
|5.1.0 to 5.1.8|5.2.4 recommended or 5.1.9|
|5.0 to 5.0.10|5.2.4 recommended |
|Any earlier versions|5.2.4 recommended |

See the release notes ([https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html]). You can download the latest version of Crowd Data Center and Server from the download center ([https://www.atlassian.com/software/crowd/download-archive]).

The National Vulnerability Database provides the following description for this vulnerability: In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Affected configurations

Vulners
Node
atlassiancrowdRange5.0.0
OR
atlassiancrowdRange5.0.1
OR
atlassiancrowdRange5.1.0
OR
atlassiancrowdRange5.0.2
OR
atlassiancrowdRange5.0.3
OR
atlassiancrowdRange5.2.3
OR
atlassiancrowdRange<5.1.9
OR
atlassiancrowdRange<5.2.4

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

High

EPSS

0.003

Percentile

65.3%