Lucene search

K
mageiaGentoo FoundationMGASA-2024-0069
HistoryMar 16, 2024 - 7:28 p.m.

Updated jackson-databind packages fix security vulnerabilities

2024-03-1619:28:17
Gentoo Foundation
advisories.mageia.org
19
jackson-databind
security vulnerabilities
resource exhaustion
denial of service
unwrap_single_value_arrays
java stackoverflow exception

7.1 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

64.3%

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. (CVE-2020-36518) In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. (CVE-2022-42003) In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. (CVE-2022-42004)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchjackson-databind< 2.11.4-2.1jackson-databind-2.11.4-2.1.mga9