Lucene search

K
osvGoogleOSV:GHSA-MPH4-VHRX-MV67
HistoryJul 05, 2019 - 9:07 p.m.

Deserialization of Untrusted Data in FasterXML jackson-databind

2019-07-0521:07:27
Google
osv.dev
17

0.533 Medium

EPSS

Percentile

97.6%

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

References