GitHub Advisory DatabaseGHSA-3X8X-79M2-3W2Wjackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
46.0%
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| com.fasterxml.jackson.core | jackson-databind | * | cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:*:*:*:*:*:*:*:* |
References
github.com/advisories/GHSA-3x8x-79m2-3w2w
github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb
github.com/FasterXML/jackson-databind/issues/3328
github.com/FasterXML/jackson/wiki/Jackson-Release-2.12.6
github.com/FasterXML/jackson/wiki/Jackson-Release-2.13.1
groups.google.com/g/jackson-user/c/OsBsirPM_Vw
nvd.nist.gov/vuln/detail/CVE-2021-46877
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
46.0%