PT-2020-5725

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.0.0 through 2.9.10.2 FasterXML jackson-databind 2.x before 2.6.7.4 FasterXML jackson-databind 2.7.x before 2.7.9.7 FasterXML jackson-databind 2.8.x before 2.8.11.5 FasterXML jackson-databind 2.9.x before...

jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the commons-dbcp gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in classes of the xalan package

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in classes of the ehcache package

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLA...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the p6spy gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

jackson-databind: Serialization gadgets in classes of the commons-configuration package

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.3.6 security update

A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariConfig gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

GHSA-R6J9-8759-G62W Improper Restriction of XML External Entity Reference in jackson-mapper-asl

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

Improper Restriction of XML External Entity Reference in jackson-mapper-asl

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes...

FasterXML Jackson jackson-databind code issue vulnerability

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A code issue vulnerability exists in version 2.x of FasterXML jackson-databind prior to 2.9.10.2. The vulnerability stems from an improperly...

PT-2020-5475 · Fasterxml +6 · Jackson-Databind +6

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.10.4 Description: The issue is related to the interaction between serialization gadgets and typing, specifically with the org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory...

PT-2020-5489 · Fasterxml +3 · Jackson-Databind +3

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.10.4 Description: The issue is related to the interaction between serialization gadgets and typing, specifically with the org.apache.commons.proxy.provider.remoting.RmiProvider component. Thi...

PT-2020-5473 · Apache +3 · Activemq-Pool +6

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.10.4 Description: The issue is related to the org.apache.activemq component of the Jackson-databind library, which mishandles the interaction between serialization gadgets and typing. This ca...

PT-2020-5474

Name of the Vulnerable Software and Affected Versions jackson-databind versions through 2.9.10.4 Description A deserialization flaw was discovered in the jackson-databind library. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core, specifically through...

PT-2020-5477

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.4 Description The issue is related to the org.apache.openjpa.ee.WASRegistryManagedRuntime component of the Jackson-databind library, which mishandles the interaction between serialization...

PT-2020-5468 · Fasterxml +3 · Jackson-Databind +3

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x prior to 2.9.10.4 Description: The issue is related to the interaction between serialization gadgets and typing in the FasterXML jackson-databind library, specifically with the...

PT-2020-5476 · Fasterxml +4 · Jackson-Databind +4

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.10.4 Description: The issue is related to the restoration of untrusted data in memory, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of...