Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues due to Apache Commons Configuration and Fasterxml jackson-databind

Summary There are vulnerabilities in Apache Commons Configuration and Fasterxml jackson-databind used by Install Agent, Integrated File Agent and Integrated Web Services in IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the...

OPENSUSE-SU-2024:10868-1 jackson-databind-2.10.5.1-2.2 on GA media

These are all security issues fixed in the jackson-databind-2.10.5.1-2.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12096-1 jackson-databind-2.13.0-2.1 on GA media

These are all security issues fixed in the jackson-databind-2.13.0-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12412-1 jackson-databind-2.13.4.2-1.1 on GA media

These are all security issues fixed in the jackson-databind-2.13.4.2-1.1 package on the GA media of openSUSE Tumbleweed...

RHEL 7 : jackson-databind (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper CVE-2017-7525 - A...

RHEL 6 : jackson-databind (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - jackson-databind: denial of service via cylic dependencies CVE-2023-35116 Note that Nessus has not tested for this...

RHEL 9 : jackson-databind (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - jackson-databind: denial of service via cylic dependencies CVE-2023-35116 Note that Nessus has not tested for this...

RHEL 8 : opendaylight (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: Serialization gadgets in classes of the ehcache package CVE-2019-17267 - A flaw was...

RHEL 7 : jasperreports-server-pro (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: Unsafe deserialization due to incomplete black list incomplete fix for CVE-2017-15095...

RHEL 8 : jboss-on (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: use of deeply nested arrays CVE-2022-42004 - jackson-databind 2.10.x through 2.12.x...

RHEL 9 : jboss-on (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jackson-databind: use of deeply nested arrays CVE-2022-42004 - In FasterXML jackson-databind before...

jackson-databind:ObjectReaderRandomClassFuzzer: Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=5121636243144704 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReaderRandomClassFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type:...

jackson-databind:ObjectReaderRandomClassFuzzer: Security exception in com.github.javaparser.ast.validator.TreeVisitorValidator.accept

Detailed Report: https://oss-fuzz.com/testcase?key=6693801816031232 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReaderRandomClassFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

jackson-databind:ObjectReaderRandomClassFuzzer: Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

Detailed Report: https://oss-fuzz.com/testcase?key=4777032427831296 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ObjectReaderRandomClassFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 273. Vulnerability Details CVEID:CVE-2024-29857 DESCRIPTION: The Bouncy Castle Crypto Package For Java is vulnerable to a denial of service, caused by improper input...

jackson-databind: denial of service via a large depth of nested objects

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...

Moderate: Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security update

An update for the pki-core:10.6 and pki-deps:10.6 modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

ALSA-2024:3061 Moderate: pki-core:10.6 and pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: jackson-databind: denial of service via a large depth of nested objects CVE-2020-36518 For more details about the security issues, including the impact, a CVSS score,...

Moderate: pki-core:10.6 and pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: jackson-databind: denial of service via a large depth of nested objects CVE-2020-36518 For more details about the security issues, including the impact, a CVSS score,...

Advisory ROSA-SA-2024-2420

Software: jackson-databind 2.10.0 OS: ROSA Virtualization 2.1 packageevrstring: jackson-databind-2.10.0 CVE-ID: CVE-2020-35490 BDU-ID: 2022-03804 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the org.apache.commons.dbcp2.datasources.PerUserPoolDataSource component of the Jackson-databind library o...