jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

Remote Code Execution (RCE)

spring-security-core is vulnerable to remote code execution RCE. Spring Security uses jackson-databind with global default typing enabled which allows the deserialization of unknown gadgets which allows remote code execution if one of the following scenarios is true: 1 The...

Remote Code Execution (RCE) Through Deserialization

Jackson-databind is vulnerable to remote code execution attacks. These attacks are possible during bean deserialization and attackers are able to execute code and commands...

PT-2017-4061

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.6.7.1 jackson-databind versions prior to 2.7.9.1 jackson-databind versions prior to 2.8.9 jackson-databind versions 2.0.0 through 2.9.5 Description A deserialization flaw in the jackson-databind library is...