RHSA-2020:4173 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

Security Bulletin: Vulnerabilities in FasterXML jackson-databind and other packages affect IBM watsonx.data

Summary FasterXML jackson-databind, multiple Huawei products, multiple Oracle products, Guava, Google Protocol Buffers, protobuf-core, Netty, JetBrains Kotlin, netplex JSON Smart, Jettison, Eclipse Jetty, SnakeYaml and Perl have vulnerabilities that can affect watsonx.data. Vulnerability Details...

jackson-databind: denial of service via cylic dependencies

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure...

Security Bulletin: Vulnerability in jackson-databind affects IBM watsonx.data

Summary FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization. This could affect IBM watsonx.data. Vulnerability Details CVEID:CVE-2020-36188 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to...

Security Bulletin: Vulnerability in jackson-databind affects IBM watsonx.data

Summary There are multiple CVEs fixed for this Security Bulletin. For the FasterXML jackson-databind CVEs, jackson-databind could allow a remote attacker to execute arbitrary code on the system. For CVE-2017-7525, Apache Struts could also allow a remote attacker to execute arbitrary code on the...

Security Bulletin: Vulnerability in jackson-databind affects IBM watsonx.data

Summary FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system and could allow a remote attacker to obtain sensitive information. This can affect watsonx.data. This can affect IBM watsonx.data Vulnerability Details CVEID:CVE-2019-12384 DESCRIPTION:...

RHSA-2017:1840 Red Hat Security Advisory: devtoolset-4-jackson-databind security update

Bulletin has no description...

RHSA-2018:0342 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2020:2320 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2020:1523 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2019:1820 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2020:4312 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2019:0782 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2019:4192 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2019:2743 Red Hat Security Advisory: rh-maven35-jackson-databind security update

Bulletin has no description...

RHSA-2018:0116 Red Hat Security Advisory: rh-eclipse46-jackson-databind security update

Bulletin has no description...

RHSA-2017:3190 Red Hat Security Advisory: rh-eclipse46-jackson-databind security update

Bulletin has no description...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004, CVE-2022-42003)

Summary IBM Sterling Partner Engagement Manager uses FasterXML jackson-databind. Vulnerability Details CVEID:CVE-2022-38751 DESCRIPTION: SnakeYAML is vulnerable to a denial of service, caused by a stack-overflow in parsing YAML files. By persuading a victim to open a specially crafted file, a...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...