ai.hyacinth.framework:core-service-discovery-server (>=0.5.0, <=0.5.24), ai.lum:odinson-rest-api_2.12 (>=0.3.1, <=0.5.0) +4009 more potentially affected by CVE-2020-28491 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.8.0.rc1, <=2.11.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.8.0.rc1, =0.5.0, =0.3.1, =j8.2.2.0, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =0.1.2, =0.1.2, =0.2.5 and more Source cves: CVE-2020-28491 Source advisory: MEND:CVE-2020-2849...

com.fasterxml.jackson.jaxrs:jackson-jaxrs-cbor-provider (>=2.12.0-rc1, <=2.12.0), com.hack23.cia:service.data.impl (>=2020-10-29, <=2020.12.20) +27 more potentially affected by CVE-2020-28491 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.12.0-rc1, <=2.12.0)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.12.0-rc1, =2.12.0-rc1, =2020-10-29, =2020-10-29, =0.26.3, =0.26.3, =0.23.1, =1.11.911, =1.11.911, =1.11.922 - org.n52.sensorweb-server.sos:sos-statistics 6.0.0-pr.1 and more Source cves: CVE-2020-28491 Source advisory:...

CVE-2020-28491

CVE-2020-28491 affects the jackson-dataformat-cbor component. An unchecked allocation of byte buffers can lead to java.lang.OutOfMemoryError. Affected versions include 0 and earlier than 2.11.4, and 2.12.0-rc1 and earlier than 2.12.1. The issue is tied to the data format CBOR handling (byte buffe...

FasterXML Jackson Resource Management Error Vulnerability

FasterXML Jackson is a data processing tool for Java from FasterXML, Inc. A resource management error vulnerability exists in FasterXML Jackson. The vulnerability stems from a failure to check the buffer length in jackson-dataformat-cbor resulting in an OutOfMemoryError exception being thrown. Th...

CVE-2020-28491: Allocation of Resources Without Limits or Throttling

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception...

PT-2021-7974

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4 com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1 Description The issue is related to the allocation of unlimited memo...

ai.faculty:dynamic-configuration_2.11 (>=0.3.2, <=0.3.3), ai.faculty:dynamic-configuration_2.13 (0.4.0) +7484 more potentially affected by CVE-2020-28491 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.3.2, <=2.11.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.3.2, =0.3.2, =3.22.0.1, =2.1.42, =3.30.0.5-1-3.0, =2.1.42, =3.30.0.5-1-3.0, =2.1.42, =3.30.0.5-1-3.0, =2.1.42, =0.5.0, =0.3.1, =1.11.0, =1.11.0, =1.11.0, =1.13.8 and more Source cves: CVE-2020-28491 Source advisory:...

com.fasterxml.jackson.jaxrs:jackson-jaxrs-cbor-provider (>=2.12.0-rc1, <=2.12.0), com.hack23.cia:service.data.impl (>=2020-10-29, <=2020.12.20) +27 more potentially affected by CVE-2020-28491 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.12.0-rc1, <=2.12.0)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.12.0-rc1, =2.12.0-rc1, =2020-10-29, =2020-10-29, =0.26.3, =0.26.3, =0.23.1, =1.11.911, =1.11.911, =1.11.922 - org.n52.sensorweb-server.sos:sos-statistics 6.0.0-pr.1 and more Source cves: CVE-2020-28491 Source advisory:...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Fedora Update for jackson-dataformat-xml FEDORA-2019-df57551f6d

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GHSA-7C2R-3JQF-C9RW jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

Versions of jackson-dataformat-xml prior to 2.7.8 and prior to 2.8.4 allow remote attackers to conduct server-side request forgery SSRF attacks via vectors related to a DTD...

ai.grakn:grakn-dist (>=0.7.0, <=0.17.0), ai.grakn:grakn-engine (>=0.6.1, <=0.18.0) +1010 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.0.0-rc2, <=2.7.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.0.0-rc2, =0.7.0, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.16.0, =0.1.0, =0.1-12, =0.1-12, =0.1-12, =0.1-16 and more Source cves: CVE-2016-7051 Source advisory: OSV:GHSA-7C2R-3JQF-C9RW...

cn.home1:oss-eureka (>=1.0.6.oss, <=1.0.7.oss), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.16-release) +172 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.8.0, <=2.8.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.8.0, =1.0.6.oss, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.8-release, =0.0.1, =3.1, =3.5.1 and more Source cves: CVE-2016-7051 Source advisory: OSV:GHSA-7C2R-3JQF-C9RW...

cn.home1:oss-eureka (>=1.0.6.oss, <=1.0.7.oss), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.16-release) +172 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.8.0, <=2.8.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.8.0, =1.0.6.oss, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.4-release, =1.1.8-release, =0.0.1, =3.1, =3.5.1 and more Source cves: CVE-2016-7051 Source advisory: GHSA-7C2R-3JQF-C9RW...

jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

Versions of jackson-dataformat-xml prior to 2.7.8 and prior to 2.8.4 allow remote attackers to conduct server-side request forgery SSRF attacks via vectors related to a DTD...

ai.grakn:grakn-dist (>=0.7.0, <=0.17.0), ai.grakn:grakn-engine (>=0.6.1, <=0.18.0) +1010 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.0.0-rc2, <=2.7.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.0.0-rc2, =0.7.0, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.16.0, =0.1.0, =0.1-12, =0.1-12, =0.1-12, =0.1-16 and more Source cves: CVE-2016-7051 Source advisory: GHSA-7C2R-3JQF-C9RW...

GHSA-HMQ6-FRV3-4727 jackson-dataformat-xml vulnerable to XML external entity (XXE)

XML external entity XXE vulnerability in XmlMapper in the Data format extension for Jackson aka jackson-dataformat-xml allows attackers to have unspecified impact via unknown vectors...

ai.grakn:grakn-dist (>=0.7.0, <=0.17.0), ai.grakn:grakn-engine (>=0.6.1, <=0.18.0) +969 more potentially affected by CVE-2016-3720 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.0.0-rc2, <=2.7.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.0.0-rc2, =0.7.0, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.16.0, =0.1.0, =0.1-12, =0.1-12, =0.1-12, =0.1-16 and more Source cves: CVE-2016-3720 Source advisory: OSV:GHSA-HMQ6-FRV3-4727...

ai.grakn:grakn-dist (>=0.7.0, <=0.17.0), ai.grakn:grakn-engine (>=0.6.1, <=0.18.0) +969 more potentially affected by CVE-2016-3720 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.0.0-rc2, <=2.7.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.0.0-rc2, =0.7.0, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.16.0, =0.1.0, =0.1-12, =0.1-12, =0.1-12, =0.1-16 and more Source cves: CVE-2016-3720 Source advisory: GHSA-HMQ6-FRV3-4727...

CVE-2016-7051

XmlMapper in the Jackson XML dataformat component aka jackson-dataformat-xml before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery SSRF attacks via vectors related to a DTD...