Unsafe Deserialization in jackson-databind

2021-12-0919:15:36

Google

osv.dev

0.005 Low

EPSS

Percentile

77.3%

JSON

FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

CPENameOperatorVersion
com.fasterxml.jackson.core:jackson-databindeq2.9.10.3
com.fasterxml.jackson.core:jackson-databindeq2.4.1.1
com.fasterxml.jackson.core:jackson-databindeq2.6.6
com.fasterxml.jackson.core:jackson-databindeq2.9.0.pr3
com.fasterxml.jackson.core:jackson-databindeq2.4.6.1
com.fasterxml.jackson.core:jackson-databindeq2.7.7
com.fasterxml.jackson.core:jackson-databindeq2.4.5.1
com.fasterxml.jackson.core:jackson-databindeq2.6.7
com.fasterxml.jackson.core:jackson-databindeq2.8.0.rc1
com.fasterxml.jackson.core:jackson-databindeq2.4.0-rc3

Name	Operator	Version
com.fasterxml.jackson.core:jackson-databind	eq	2.9.10.3
com.fasterxml.jackson.core:jackson-databind	eq	2.4.1.1
com.fasterxml.jackson.core:jackson-databind	eq	2.6.6
com.fasterxml.jackson.core:jackson-databind	eq	2.9.0.pr3
com.fasterxml.jackson.core:jackson-databind	eq	2.4.6.1
com.fasterxml.jackson.core:jackson-databind	eq	2.7.7
com.fasterxml.jackson.core:jackson-databind	eq	2.4.5.1
com.fasterxml.jackson.core:jackson-databind	eq	2.6.7
com.fasterxml.jackson.core:jackson-databind	eq	2.8.0.rc1
com.fasterxml.jackson.core:jackson-databind	eq	2.4.0-rc3