The vulnerability of the.fasterxml.jackson.dataformat:jackson-dataformat-cbor package from the jackson-dataformats-binary library allows a attacker to trigger a service failure.

🗓️ 06 Dec 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The jackson dataformat cbor vulnerability in jackson-dataformats-binary allows unlimited memory.

Reporter	Title	Published	Views	Family All 71
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	29 Jun 202123:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-dataformat	14 May 202101:37	–	ibm
IBM Security Bulletins	Security Bulletin: Jackson-Dataformats Vulnerability Affects the B2B API of IBM Sterling B2B Integrator (CVE-2020-28491)	5 Oct 202120:41	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in FasterXML jackson-binary affects watsonx.data	3 Sep 202421:04	–	ibm
IBM Security Bulletins	Security Bulletin: FasterXML jackson-databind vulnerabilites impact IBM Sterling Order Management	6 Oct 202322:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	8 Nov 202220:16	–	ibm
IBM Security Bulletins	Security Bulletin: Information disclosure in FasterXML Jackson Dataformats affect IBM Operations Analytics - Log Analysis (CVE-2020-28491)	22 Nov 202213:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities Have been addressed in IBM Security Access Manager	15 Oct 202120:24	–	ibm
Circl	CVE-2020-28491	18 Feb 202118:50	–	circl
CNNVD	FasterXML Jackson Resource Management Error Vulnerability	18 Feb 202100:00	–	cnnvd

Vulners

Node

oracle weblogic_serverMatch12.2.1.3.0

OR

red_hat openshift_container_platformMatch3.11

OR

oracle weblogic_serverMatch12.2.1.4.0

OR

red_hat openshift_container_platformMatch4

OR

oracle weblogic_serverMatch14.1.1.0.0

OR

red_hat openshift_loggingMatch5.1

OR

red_hat openshift_loggingMatch5.2

OR

red_hat openshift_loggingMatch5.3

OR

novell suse_manager_proxyMatch4.2

OR

novell suse_manager_serverMatch4.2

OR

novell suse_enterprise_storageMatch7

OR

novell suse_manager_serverMatch4.1

OR

novell suse_manager_proxyMatch4.1

OR

novell suse_manager_retail_branch_serverMatch4.1

OR

novell suse_manager_retail_branch_serverMatch4.2

OR

novell suse_manager_retail_branch_serverMatch4.3

OR

novell suse_manager_proxyMatch4.3

OR

novell suse_manager_serverMatch4.3

OR

novell suse_enterprise_storageMatch7.1

OR

fasterxml,_llc jackson-dataformats-binaryRange<2.11.4

OR

fasterxml,_llc jackson-dataformats-binaryRange2.12.0–2.12.1

OR

red_hat quarkusRange<2.0.2

OR

red_hat red_hat_build_of_quarkusMatch2.2.3

OR

red_hat red_hat_fuseMatch7.10

OR

red_hat red_hat_single_sign-onMatch7.4.9

OR

red_hat red_hat_descision_managerMatch7.12.0

OR

red_hat red_hat_process_automation_managerMatch7.12.0

OR

sonarsource sonarqubeMatch9.3.3

OR

novell opensuse_leapMatch15.4

OR

canonical ubuntuMatch23.04

OR

canonical ubuntuMatch23.10

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-28491
access	www.access.redhat.com/security/cve/CVE-2020-28491
ubuntu	www.ubuntu.com/security/CVE-2020-28491
suse	www.suse.com/security/cve/CVE-2020-28491.html
oracle	www.oracle.com/security-alerts/cpujul2022.html
web	www.web.nvd.nist.gov/view/vuln/detail

11 Dec 2023 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.5

CVSS 27.8

EPSS0.03074

jackson dataformat cbor unlimited memory service disruption jackson dataformats binary vulnerability