Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage SDK Java (Feb 2019, updated)

Summary Multiple vulnerabilities affect IBM Cloud Object Storage SDK Java. These vulnerabilities have been addressed in the latest SDK Java releases. Vulnerability Details CVE-ID: CVE-2018-19362 Description: An unspecified error with failure to block the jboss-common-core class from polymorphic...

Unsafe Dependency Resolution

Overview com.fasterxml.jackson.module:jackson-module-scala is an Add-on module for Jackson http://wiki.fasterxml.com/JacksonHome to support Scala-specific datatypes. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure...

com.datasift.dropwizard:dropwizard-extra-scala (>=0.6.0-2, <=0.6.2-6), com.github.kongchen:swagger-maven-plugin (1.0) +34 more potentially affected by unknown CVE via com.fasterxml.jackson.module:jackson-module-scala (>=2.0.0, <=2.1.2)

com.fasterxml.jackson.module:jackson-module-scala MAVEN version =2.0.0, =0.6.0-2, =1.1, =mvn+release:perform, =0.2.4, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.2.2 - com.wordnik:swagger-jersey-jaxrs2.10.0 1.2.2 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONMODULE-174825...

FasterXML Jackson-databind code issue vulnerability (CNVD-2019-37150)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind versions prior to 2.7.9.4, prior to 2.8.11.2, and prior to 2.9.6. An attacker can...

[SECURITY] Fedora 29 Update: jackson-datatype-joda-2.9.8-1.fc29

This is a Jackson module that aims to provide full support for data types of Joda date-time library...

[SECURITY] Fedora 29 Update: jackson-dataformat-xml-2.9.8-1.fc29

Data format extension for Jackson http://jackson.codehaus.org to offer alternative support for serializing POJOs as XML and deserializing XML as POJOs. Support implemented on top of Stax API javax.xml.stream, by implementing core Jackson Streaming API types like JsonGenerator, JsonParser and...

[SECURITY] Fedora 29 Update: jackson-datatype-jdk8-2.9.8-1.fc29

Java 8 Datatypes: support for other new Java 8 data types outside of date/time: most notably Optional, OptionalLong, OptionalDouble...

[SECURITY] Fedora 29 Update: jackson-datatypes-collections-2.9.8-1.fc29

This is a multi-module umbrella project for various Jackson Data-type modules to support 3rd party Collection libraries. Currently included are: Guava data-type HPPC data-type PCollections data-type...

[SECURITY] Fedora 29 Update: jackson-jaxrs-providers-2.9.8-1.fc29

This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML...

[SECURITY] Fedora 29 Update: jackson-modules-base-2.9.8-1.fc29

Jackson "base" modules: modules that build directly on databind, and are not data-type, data format, or JAX-RS provider modules...

[SECURITY] Fedora 29 Update: jackson-parent-2.9.1.2-1.fc29

Project for parent pom for all Jackson components...

[SECURITY] Fedora 29 Update: jackson-dataformats-text-2.9.8-1.fc29

Parent pom for Jackson text-format dataformats...

[SECURITY] Fedora 29 Update: jackson-annotations-2.9.8-1.fc29

Core annotations used for value types, used by Jackson data-binding package...

[SECURITY] Fedora 29 Update: jackson-bom-2.9.8-1.fc29

A "bill of materials" POM for Jackson dependencies...

[SECURITY] Fedora 29 Update: jackson-core-2.9.8-1.fc29

Core part of Jackson that defines Streaming API as well as basic shared abstractions...

[SECURITY] Fedora 29 Update: jackson-databind-2.9.8-1.fc29

The general-purpose data-binding functionality and tree-model for Jackson D ata Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration...

[SECURITY] Fedora 29 Update: jackson-dataformats-binary-2.9.8-1.fc29

Parent pom for Jackson binary dataformats...

Security Bulletin: IBM InfoSphere Change Data Capture is affected by a jackson-core open source library vulnerability (CVE-2018-0125)

Summary InfoSphere Data Replication has addressed the following vulnerability: CVE-2018-0125 Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete input validation on user-controll...

Remote Code Execution

jackson-databind is vulnerable to remote code execution. The vulnerability exists because it does not restrict the data sources for the Jodd-db object type, leading to deserialisation of arbitrary data from external untrusted sources which would allow an attacker to execute arbitrary code...

payara -- multiple vulnerabilities

Payara Releases reports: The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases: CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct...