32 matches found
jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*
A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...
jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution
A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...
[SECURITY] Fedora 31 Update: jackson-databind-2.10.0-1.fc31
The general-purpose data-binding functionality and tree-model for Jackson D ata Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration...
[SECURITY] Fedora 31 Update: jackson-annotations-2.10.0-1.fc31
Core annotations used for value types, used by Jackson data-binding package...
DEBIAN-CVE-2019-17531
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the apache-log4j-extra version 1.2.x jar in the classpath, and an...
[SECURITY] Fedora 30 Update: jackson-databind-2.9.9.3-1.fc30
The general-purpose data-binding functionality and tree-model for Jackson D ata Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration...
[SECURITY] Fedora 30 Update: jackson-annotations-2.9.9-1.fc30
Core annotations used for value types, used by Jackson data-binding package...
Data format extension for Jackson cross-site request forgery vulnerability
Data format extension for Jackson aka jackson-dataformat-xml is an extension module for providing alternative support for serialized POJO classes for XML and deserialized XML. A security vulnerability exists in XmlMapper in the Data format extension for Jackson. A remote attacker could exploit th...
CVE-2016-3720
XML external entity XXE vulnerability in XmlMapper in the Data format extension for Jackson aka jackson-dataformat-xml allows attackers to have unspecified impact via unknown vectors...
DEBIAN-CVE-2016-3720
XML external entity XXE vulnerability in XmlMapper in the Data format extension for Jackson aka jackson-dataformat-xml allows attackers to have unspecified impact via unknown vectors...
