The vulnerability of the Jackson-databind library in the FasterXML project allows a hacker to induce a service failure.

🗓️ 07 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Jackson databind vulnerability from FasterXML may cause service failure due to unlimited resource distribution.

Reporter	Title	Published	Views	Family All 96
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Fasterxml jackson-databind [CVE-2023-35116]	25 Apr 202418:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion may be vulnerable to denial of service due to jackson-databind, okio (CVE-2022-42003, CVE-2023-35116, CVE-2023-3635)	21 Dec 202317:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability CVE-2023-35116 affects CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.	16 Oct 202316:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities	9 Feb 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz Reporting Service is vulnerable to a denial of service (CVE-2023-35116)	16 Oct 202313:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues due to Apache Commons Configuration and Fasterxml jackson-databind	19 Jun 202410:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Symphony with Fasterxml jackson-databind is vulnerable to a denial of service, caused by a stack-based overflow	28 Feb 202415:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance - Identity Manager has multiple vulnerabilities	22 Apr 202406:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion HCI may be vulnerable to denial of service due to jackson-databind, okio (CVE-2022-42003, CVE-2023-35116, CVE-2023-3635)	21 Dec 202317:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	24 Oct 202319:01	–	ibm

Vulners

Node

red_hat jboss_fuseMatch7

OR

red_hat red_hat_single_sign-onMatch7

OR

red_hat red_hat_jboss_data_gridMatch7

OR

red_hat jboss_fuseMatch6

OR

red_hat red_hat_process_automationMatch7

OR

red_hat decision_managerMatch7

OR

red_hat red_hat_jboss_a-mqMatch7

OR

red_hat cryostatMatch2

OR

red_hat red_hat_build_of_optaplannerMatch8

OR

fasterxml,_llc jackson-databindRange<2.16.0

OR

red_hat red_hat_data_gridMatch8.4.3

OR

red_hat red_hat_enterprise_linuxMatch8

OR

red_hat red_hat_enterprise_linuxMatch9

Source	Link
access	www.access.redhat.com/errata/RHSA-2023:5396
access	www.access.redhat.com/security/cve/CVE-2023-35116
github	www.github.com/FasterXML/jackson-databind/issues/3972
web	www.web.nvd.nist.gov/view/vuln/detail
rhn	www.rhn.redhat.com/errata/RHSA-2023:5396.html

07 Feb 2024 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 23.8

CVSS 34.7

EPSS0.00352

jackson databind fasterxml project unlimited resource distribution service failure