Lucene search

K
atlassianSecurity-metrics-botCWD-5903
HistoryJan 12, 2023 - 9:57 a.m.

Bump jackson-databind dependency to 2.13.4.2

2023-01-1209:57:47
security-metrics-bot
jira.atlassian.com
30

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

60.0%

Embedded Crowd library has transitive dependency to vulnerable library
{code:java}
com.fasterxml.jackson.core:jackson-databind:jar:2.12.1 - CVE-2020-36518{code}
It is being included through Crowd dependency to {{com.microsoft.azure:msal4j:jar:1.11.0}}
The affected versions are before version 5.0.4.

Affected versions:

  • version < 5.0.4

Fixed versions:

  • 5.0.4

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

60.0%