UBUNTU-CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540...

CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540...

CVE-2019-16335

CVE-2019-16335 is a vulnerability in FasterXML jackson-databind (pre-2.9.10) related to polymorphic typing in the HikariDataSource path. Connected sources confirm the affected component is jackson-databind and specifically the serialization gadgets involving com.zaxxer.hikari.HikariDataSource. Im...

CVE-2019-16335

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540...

CVE-2019-14540

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig...

CVE-2019-14540

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig...

CVE-2019-14540

CVE-2019-14540 affects jackson-databind up to version 2.9.10 with serialization gadget risk involving the HikariCP classes (com.zaxxer.hikari.HikariConfig). The authoritative initial doc notes a polymorphic typing issue in jackson-databind related to HikariConfig. Connected-material references (A...

Unspecified vulnerability in FasterXML jackson-databind (CNVD-2019-37174)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind versions prior to 2.9.10, which can be exploited by attackers to execute code...

Important: Red Hat Security Advisory: rh-maven35-jackson-databind security update

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fixes: jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution...

RLSA-2019:2720 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by Rocky Enterprise Software Foundation Certificate System. Security Fixes: jackson-databind: failure to block the logback-core class from polymorphic deserialization leadi...

ALSA-2019:2720 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fixes: jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution...

Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind

It is an offensive tool for Java. This PoC exploit targets CVE-2...

The vulnerability of the logback-core class in the Jackson-databind library, allowing attackers to execute arbitrary code.

The vulnerability of the logback-core class in the Jackson-databind library is related to the memory restoration of unreliable data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis is related to the inability to prevent the OpenJPA class from being polymorphic deserialization. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or caus...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows attackers to compromise data integrity, gain access to confidential information, and cause service failures.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file parsing involves a failure to prevent polymorphic deserialization of the axis2-transport-jms class. Exploiting this vulnerability could allow an attacker to compromise data integrity, gain access to...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows a attacker to gain access to confidential data.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file parsing involves the ability to read any local files on the server when default typing is enabled. A special jar-connector-mysql-connector-java is also available and points to classes at the final JSON...

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis allows attackers to compromise data integrity, gain access to confidential information, and cause service failures.

The vulnerability of the FasterXML function in the Jackson-Databind Java library for JSON file grammar analysis is related to the blocking of the polymorphic deserialization in the jboss-common-core class. Exploiting this vulnerability could allow an attacker to compromise data integrity, gain...