CVE-2016-7051

CVE-2016-7051 affects jackson-dataformat-xml (XmlMapper). The vulnerability is a server-side request forgery (SSRF) flaw related to DTD handling, present in XmlMapper before 2.7.8 and in 2.8.x before 2.8.4. Impact is described as potential SSRF; exploit details are not provided in the initial doc...

CVE-2016-7051

XmlMapper in the Jackson XML dataformat component aka jackson-dataformat-xml before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery SSRF attacks via vectors related to a DTD...

ai.grakn:grakn-dist (>=0.7.0, <=0.17.0), ai.grakn:grakn-engine (>=0.6.1, <=0.18.0) +1010 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.0.0-rc2, <=2.7.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.0.0-rc2, =0.7.0, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.16.0, =0.1.0, =0.1-12, =0.1-12, =0.1-12, =0.1-16 and more Source cves: CVE-2016-7051 Source advisory: MEND:CVE-2016-7051...

cn.home1:oss-eureka (>=1.0.6.oss, <=1.0.7.oss), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.16-release) +172 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.8.0, <=2.8.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.8.0, =1.0.6.oss, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.8-release, =0.0.1, =3.1, =3.5.1 and more Source cves: CVE-2016-7051 Source advisory: MEND:CVE-2016-7051...

PT-2017-9078

Name of the Vulnerable Software and Affected Versions jackson-dataformat-xml versions 2.7.0 through 2.7.7 jackson-dataformat-xml versions 2.8.0 through 2.8.3 Description The issue allows remote attackers to conduct server-side request forgery SSRF attacks via vectors related to a DTD. This can be...

CVE-2016-7051: Improper Restriction of XML External Entity Reference

XmlMapper in the Jackson XML dataformat component aka jackson-dataformat-xml before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery SSRF attacks via vectors related to a DTD...

PT-2017-4061

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.6.7.1 jackson-databind versions prior to 2.7.9.1 jackson-databind versions prior to 2.8.9 jackson-databind versions 2.0.0 through 2.9.5 Description A deserialization flaw in the jackson-databind library is...

Multiple Remote Code Execution Vulnerabilities in Apache Camel Java Deserialization

Apache Camel is the United States Apache Apache Software Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern, referred to as EIP integration framework. The framework provides Enterprise Integration Pattern Java objects POJO implementation , an...

Remote code execution

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...

CVE-2016-8749

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...

CVE-2016-8749

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...

com.github.camel-labs:camel-labs-iot-cloudlet-document-driver (0.1.0), com.github.camel-labs:camel-labs-iot-cloudlet-geofencing (0.1.0) +104 more potentially affected by CVE-2016-8749 via org.apache.camel:camel-jackson (>=2.10.0, <=2.16.4)

org.apache.camel:camel-jackson MAVEN version =2.10.0, =0.1, =0.0.9, =0.0.19, =0.0.8, =0.0.16, =0.0.17, =0.0.16, =1.5, =1.5, =1.5, =1.5, =1.9.3 - edu.amherst.acdc:acrepo-template-mustache 1.0.0 and more Source cves: CVE-2016-8749 Source advisory: MEND:CVE-2016-8749...

com.zerotoheroes:hs-draft-odds (>=1.0.0, <=1.0.2), com.zerotoheroes:hs-game-converter (>=1.0.0, <=1.0.12) +32 more potentially affected by CVE-2016-8749 via org.apache.camel:camel-jackson (>=2.17.0, <=2.17.4)

org.apache.camel:camel-jackson MAVEN version =2.17.0, =1.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.7, =1.1.0-m1, =2.2.105, =2.2.105, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.7 and more Source cves: CVE-2016-8749 Source advisory: MEND:CVE-2016-8749...

ca.islandora.alpaca:islandora-indexing-triplestore (>=0.2.0, <=0.7.1), cool.pandora:acrepo-exts-image (0.0.3) +279 more potentially affected by CVE-2016-8749 via org.apache.camel:camel-jackson (>=2.18.0, <=2.18.1)

org.apache.camel:camel-jackson MAVEN version =2.18.0, =0.2.0, =1.0.8, =1.0.8, =1.0.10, =1.1.0, =1.0.8, =1.0.8, =1.1.0, =1.0.8, =1.0.8, =1.0.8, =0.0.7, =0.0.7, =0.0.10 and more Source cves: CVE-2016-8749 Source advisory: MEND:CVE-2016-8749...

CVE-2016-8749

Apache Camel (camel-jackson and camel-jacksonxml) is affected by CVE-2016-8749 due to unsafe Java object deserialization during Jackson/JacksonXML unmarshalling, enabling remote code execution. The issue is documented across multiple feeds (GHSA and Red Hat advisories) and affects Camel component...

PT-2017-9780

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.16.5 Apache Camel versions prior to 2.17.5 Apache Camel versions prior to 2.18.2 Description The issue concerns a Java object de-serialization vulnerability in Apache Camel's Jackson and JacksonXML unmarshallin...

CVE-2016-8749: Deserialization of Untrusted Data

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks...

WS-2017-3750

In Jackson-core, versions jackson-core-2.0.0 to jackson-core-2.8.5, jackson-core does not limit the length of its token, which causes a security issue that allows an attacker to remotely flood the server’s logs using invalid data...

WS-2016-7080

In Jackson-core, versions jackson-core-2.0.0 to jackson-core-2.8.5, jackson-core does not limit the length of its token, which causes a security issue, that allows an attacker to remotely flood the server’s logs using invalid data...

Fedora 22 : jackson-dataformat-xml (2016-d708261ce2)

Security fix for CVE-2016-3720 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...