[SECURITY] Fedora 29 Update: jackson-datatype-jdk8-2.9.8-1.fc29

Java 8 Datatypes: support for other new Java 8 data types outside of date/time: most notably Optional, OptionalLong, OptionalDouble...

[SECURITY] Fedora 29 Update: jackson-datatypes-collections-2.9.8-1.fc29

This is a multi-module umbrella project for various Jackson Data-type modules to support 3rd party Collection libraries. Currently included are: Guava data-type HPPC data-type PCollections data-type...

[SECURITY] Fedora 29 Update: jackson-modules-base-2.9.8-1.fc29

Jackson "base" modules: modules that build directly on databind, and are not data-type, data format, or JAX-RS provider modules...

[SECURITY] Fedora 29 Update: jackson-parent-2.9.1.2-1.fc29

Project for parent pom for all Jackson components...

[SECURITY] Fedora 29 Update: jackson-jaxrs-providers-2.9.8-1.fc29

This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML...

[SECURITY] Fedora 29 Update: jackson-annotations-2.9.8-1.fc29

Core annotations used for value types, used by Jackson data-binding package...

[SECURITY] Fedora 29 Update: jackson-core-2.9.8-1.fc29

Core part of Jackson that defines Streaming API as well as basic shared abstractions...

[SECURITY] Fedora 29 Update: jackson-bom-2.9.8-1.fc29

A "bill of materials" POM for Jackson dependencies...

[SECURITY] Fedora 29 Update: jackson-dataformats-binary-2.9.8-1.fc29

Parent pom for Jackson binary dataformats...

[SECURITY] Fedora 29 Update: jackson-dataformats-text-2.9.8-1.fc29

Parent pom for Jackson text-format dataformats...

[SECURITY] Fedora 29 Update: jackson-databind-2.9.8-1.fc29

The general-purpose data-binding functionality and tree-model for Jackson D ata Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration...

Security Bulletin: IBM InfoSphere Change Data Capture is affected by a jackson-core open source library vulnerability (CVE-2018-0125)

Summary InfoSphere Data Replication has addressed the following vulnerability: CVE-2018-0125 Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete input validation on user-controll...

Remote Code Execution

jackson-databind is vulnerable to remote code execution. The vulnerability exists because it does not restrict the data sources for the Jodd-db object type, leading to deserialisation of arbitrary data from external untrusted sources which would allow an attacker to execute arbitrary code...

payara -- multiple vulnerabilities

Payara Releases reports: The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases: CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct...

The vulnerability of the Core component (jackson-databind) of the Primavera Unifier application, which allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the Core component jackson-databind of the Primavera Unifier application for automating project management processes is related to errors in the code. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code or cause service failures using the HTTP...

Remote Code Execution (RCE)

Jackson-databind is vulnerable to remote code execution RCE attacks. Attackers can exploit an incomplete fix of CVE-2017-7525 to bypass the blacklist when Spring libraries are available on the class path. In order to be vulnerable to this attack, either the use of @JsonTypeInfouse =...

Remote Code Execution (RCE) Through Deserialization

Jackson-databind is vulnerable to remote code execution RCE attacks. These attacks are possible during bean deserialization. Using this flaw attackers are able to execute code and commands. In order to be vulnerable to this attack, either the use of @JsonTypeInfouse = JsonTypeInfo.Id.CLASS or...

GHSA-4GQ5-CH57-C2MG Arbitrary Code Execution in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

Arbitrary Code Execution in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization...

GHSA-X2W5-5M2G-7H5M XML External Entity Reference (XXE) in jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity XXE attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization...