Deserialization of untrusted data in jackson-databind

2021-01-2021:20:15

Google

osv.dev

0.004 Low

EPSS

Percentile

74.7%

JSON

A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CPENameOperatorVersion
com.fasterxml.jackson.core:jackson-databindeq2.9.10.3
com.fasterxml.jackson.core:jackson-databindeq2.4.1.1
com.fasterxml.jackson.core:jackson-databindeq2.6.6
com.fasterxml.jackson.core:jackson-databindeq2.9.0.pr3
com.fasterxml.jackson.core:jackson-databindeq2.0.0-RC1
com.fasterxml.jackson.core:jackson-databindeq2.4.6.1
com.fasterxml.jackson.core:jackson-databindeq2.7.7
com.fasterxml.jackson.core:jackson-databindeq2.4.5.1
com.fasterxml.jackson.core:jackson-databindeq2.6.7
com.fasterxml.jackson.core:jackson-databindeq2.8.0.rc1

Name	Operator	Version
com.fasterxml.jackson.core:jackson-databind	eq	2.9.10.3
com.fasterxml.jackson.core:jackson-databind	eq	2.4.1.1
com.fasterxml.jackson.core:jackson-databind	eq	2.6.6
com.fasterxml.jackson.core:jackson-databind	eq	2.9.0.pr3
com.fasterxml.jackson.core:jackson-databind	eq	2.0.0-RC1
com.fasterxml.jackson.core:jackson-databind	eq	2.4.6.1
com.fasterxml.jackson.core:jackson-databind	eq	2.7.7
com.fasterxml.jackson.core:jackson-databind	eq	2.4.5.1
com.fasterxml.jackson.core:jackson-databind	eq	2.6.7
com.fasterxml.jackson.core:jackson-databind	eq	2.8.0.rc1