CVE-2018-12022

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Jodd-db jar for database access for the Jodd framework in the classpath, and an attacker can provide an LDAP...

CVE-2018-12022

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Jodd-db jar for database access for the Jodd framework in the classpath, and an attacker can provide an LDAP...

CVE-2018-12022

CVE-2018-12022 affects FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (globally or for a property) and the service classpath contains the Jodd‑db jar (for Jodd DB access) with an LDAP service available, an attacker can trigger remote code executio...

CVE-2018-12022

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Jodd-db jar for database access for the Jodd framework in the classpath, and an attacker can provide an LDAP...

CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to ma...

CVE-2018-12023

The CVE-2018-12023 issue affects FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (globally or per-property) and the Oracle JDBC jar is in the classpath with an LDAP service accessible to an attacker, the service could be coerced into executing a ma...

CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to ma...

aero.champ:cargojson (1.0), ai.genauth:genauth-java-sdk (3.1.11) +10389 more potentially affected by CVE-2018-12023 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.5)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

ai.agnos:reactive-sparql_2.12 (>=0.3.0, <=0.3.1), ai.databand:dbnd-agent (>=0.42.1, <=0.80.6) +5691 more potentially affected by CVE-2018-12023 via com.fasterxml.jackson.core:jackson-databind (>=2.7.0, <=2.7.9.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.7.0, =0.3.0, =0.42.1, =0.42.1, =0.40.2, =0.42.1, =0.2, =0.8.0, =3.3.3, =0.0.1, =0.0.2, =0.0.3 - at.ac.ait.lablink.clients:sync 0.0.1 - at.ac.ait.lablink:core 0.0.1 and more Source cves: CVE-2018-12023 Source advisory: MEND:CVE-2018-1202...

CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to ma...

ai.grakn:grakn (>=0.17.0, <=0.18.0), ai.grakn:grakn-client (>=0.17.0, <=0.18.0) +13965 more potentially affected by CVE-2018-12023 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0, <=2.8.11.1)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.17.0, =0.16.0, =0.18.0 and more Source cves: CVE-2018-12023 Source advisory: MEND:CVE-2018-12023...

CVE-2018-12022: Deserialization of Untrusted Data

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Jodd-db jar for database access for the Jodd framework in the classpath, and an attacker can provide an LDAP...

CVE-2018-12023: Deserialization of Untrusted Data

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to ma...

Unspecified vulnerability in FasterXML jackson-databind

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind versions prior to 2.7.9.4, prior to 2.8.11.2, and prior to 2.9.6. An attacker can...

Security Bulletin: Multiple vulnerabilities have been identified in FasterXML Jackson library shipped with IBM Tivoli Netcool/OMNIbus Common Integration Libraries (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2018-1000873)

Summary FasterXML Jackson library is shipped as a component of IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library and Transformer for Message Bus Integration. Information about security vulnerabilities affecting FasterXML Jackson library has been published. The Netcool/OMNIbus...

Debian DLA-1703-1 : jackson-databind security update

Several deserialization flaws were discovered in jackson-databind, a fast and powerful JSON library for Java, which could allow an unauthenticated user to perform code execution. The issue was resolved by extending the blacklist and blocking more classes from polymorphic deserialization. For Debi...

[SECURITY] [DLA 1703-1] jackson-databind security update

Package : jackson-databind Version : 2.4.2-2+deb8u5 CVE ID : CVE-2018-11307 CVE-2018-12022 CVE-2018-12023 CVE-2018-14718 CVE-2018-14719 CVE-2018-14720 CVE-2018-14721 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 Several deserialization flaws were discovered in jackson-databind, a fast and powerful...

DLA-1703-1 jackson-databind - security update

Bulletin has no description...

Debian: Security Advisory (DLA-1703-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Public disclosed vulnerabilities from Jackson-databind affects IBM Spectrum LSF

Summary Public disclosed vulnerabilities from Jackson-databind affects IBM Spectrum LSF: CVE-2017-7525, CVE-2017-15095, CVE-2017-17485, CVE-2018-5968, CVE-2018-7489 Vulnerability Details CVE-2017-7525 Jackson-databind Also implemented in JBoss BPM Suite is vulnerable to remote code execution when...