Lucene search

K
osvGoogleOSV:GHSA-P43X-XFJF-5JHR
HistoryMay 15, 2020 - 6:59 p.m.

jackson-databind mishandles the interaction between serialization gadgets and typing

2020-05-1518:59:01
Google
osv.dev
70
fasterxml
jackson-databind
2.x
mishandles
serialization gadgets
typing
br.com.anteros.dbcp.anterosdbcpconfig
anteros-core
software

EPSS

0.004

Percentile

73.8%

FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

References