Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to FasterXML jackson-databind denial of service (CVE-2022-42004)

Summary Potential vulnerabilities in FasterXML jackson-databind which is caused by a lack of a check in in the BeanDeserializer.deserializeFromArray function CVE-2022-42004 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional...

PT-2022-37734

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53822 Crash type: Security exception Crash state: com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserialize com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializerNR.deserialize...

jackson-databind:AdaLObjectReader3Fuzzer: Security exception in com.fasterxml.jackson.databind.jsontype.impl.AsArrayTypeDeserializer.deserialize

Detailed Report: https://oss-fuzz.com/testcase?key=5145374413422592 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: AdaLObjectReader3Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Debian: Security Advisory (DLA-3207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3207-1] jackson-databind security update

Debian LTS Advisory DLA-3207-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 27, 2022 https://wiki.debian.org/LTS Package : jackson-databind Version : 2.9.8-3+deb10u4 CVE ID : CVE-2020-36518 CVE-2022-42003 CVE-2022-42004 Debian Bug : 1007109 Several fla...

DLA-3207-1 jackson-databind - security update

Bulletin has no description...

Debian dla-3207 : libjackson2-databind-java - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3207 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3207-1 [email protected]...

jackson-databind:AdaLObjectReader3Fuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6011852725551104 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: AdaLObjectReader3Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...

jackson-databind:ReadTreeFuzzer: Security exception in com.fasterxml.jackson.databind.node.ObjectNode.serialize

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=5646019524427776 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: ReadTreeFuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security exception...

Debian DSA-5283-1 : jackson-databind - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5283 advisory. - jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. CVE-2020-36518 - In FasterXML...

Debian: Security Advisory (DSA-5283-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5283-1] jackson-databind security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5283-1 [email protected] https://www.debian.org/security/ Markus Koschany November 17, 2022 https://www.debian.org/security/faq -...

DSA-5283-1 jackson-databind - security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: Logging Subsystem 5.4.8 - Red Hat OpenShift security update

An update is now available for Logging subsystem for Red Hat OpenShift 5.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

SUSE: Security Advisory (SUSE-SU-2022:3995-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jackson-databind (SUSE-SU-2022:3995-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3995-1 advisory. Update to version 2.13.4.2: - CVE-2022-42003: Fixed missing check in primitive value deserialize...

SUSE-SU-2022:3995-1 Security update for jackson-databind

This update for jackson-databind fixes the following issues: Update to version 2.13.4.2: - CVE-2022-42003: Fixed missing check in primitive value deserializers to avoid deep wrapper array nesting wrt 'UNWRAPSINGLEVALUEARRAYS' bsc1204370. - CVE-2022-42004: Fixed missing check in...

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004)

Summary There is a vulnerability in FasterXML jackson-databind used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVE CVE-2022-42004. Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable t...

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42003)

Summary There is a vulnerability in FasterXML jackson-databind used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVE CVE-2022-42003. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable t...

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to denial of service due to FasterXML jackson-databind

Summary There is a vulnerability in FasterXML jackson-databind used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable vulnerability. Vulnerability Details IBM X-Force ID: 217968 DESCRIPTION: FasterXML jackson-databind is vulnerable to a...