Deserialization of untrusted data in Jackson Databind

2020-06-1814:44:43

Google

osv.dev

0.034 Low

EPSS

Percentile

91.5%

JSON

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

CPENameOperatorVersion
com.fasterxml.jackson.core:jackson-databindeq2.9.0.pr1
com.fasterxml.jackson.core:jackson-databindeq2.9.10
com.fasterxml.jackson.core:jackson-databindeq2.9.9.3
com.fasterxml.jackson.core:jackson-databindeq2.9.10.2
com.fasterxml.jackson.core:jackson-databindeq2.9.0
com.fasterxml.jackson.core:jackson-databindeq2.9.8
com.fasterxml.jackson.core:jackson-databindeq2.9.1
com.fasterxml.jackson.core:jackson-databindeq2.9.0.pr2
com.fasterxml.jackson.core:jackson-databindeq2.9.5
com.fasterxml.jackson.core:jackson-databindeq2.9.0.pr3

Name	Operator	Version
com.fasterxml.jackson.core:jackson-databind	eq	2.9.0.pr1
com.fasterxml.jackson.core:jackson-databind	eq	2.9.10
com.fasterxml.jackson.core:jackson-databind	eq	2.9.9.3
com.fasterxml.jackson.core:jackson-databind	eq	2.9.10.2
com.fasterxml.jackson.core:jackson-databind	eq	2.9.0
com.fasterxml.jackson.core:jackson-databind	eq	2.9.8
com.fasterxml.jackson.core:jackson-databind	eq	2.9.1
com.fasterxml.jackson.core:jackson-databind	eq	2.9.0.pr2
com.fasterxml.jackson.core:jackson-databind	eq	2.9.5
com.fasterxml.jackson.core:jackson-databind	eq	2.9.0.pr3