Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatRedHatRHSA-2023:0471
HistoryJan 26, 2023 - 12:13 p.m.

(RHSA-2023:0471) Important: Migration Toolkit for Runtimes security update

2023-01-2612:13:39
access.redhat.com
28
rhsa-2023-0471
jib-core
cve-2022-25914
apache-commons-bcel
cve-2022-42920
nodejs-minimatch
cve-2022-3517
loader-utils
cve-2022-37603
jackson-databind
cve-2022-42003
cve-2022-42004
security update
rce
arbitrary bytecode
redos
denial of service
unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.025

Percentile

90.1%

JSON

Security Fix(es):

  • jib-core: RCE via the isDockerInstalled (CVE-2022-25914)
  • Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)
  • nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
  • loader-utils: Regular expression denial of service (CVE-2022-37603)
  • jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
  • jackson-databind: use of deeply nested arrays (CVE-2022-42004)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Related

ibm 57
nessus 34
openvas 15
gentoo 1
redhat 6
mageia 1
osv 17
debian 2
nvd 5
cve 5
redhatcve 5
prion 5
veracode 5
github 4
cvelist 4
debiancve 3
ubuntucve 4
rocky 1
fedora 3
centos 1
redos 1
amazon 2
oraclelinux 2
almalinux 1
atlassian 8
f5 2
broadcom 2
cgr 2
wolfi 1
ibm
ibm
Security Bulletin: There are several vulnerabilities in jackson-databind used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-42003, CVE-2022-42004)
2023-05-02 21:10:24
Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42003, CVE-2022-42004)
2023-02-09 18:02:05
Security Bulletin: IBM Storage Protect Server is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004, CVE-2022-42003)
2023-06-22 18:28:22
nessus
nessus
RHEL 9 : jboss-on (Unpatched Vulnerability)
2024-06-03 00:00:00
SUSE SLED15 / SLES15 Security Update : jackson-databind (SUSE-SU-2022:3995-1)
2022-11-16 00:00:00
GLSA-202210-21 : FasterXML jackson-databind: Multiple vulnerabilities
2022-10-31 00:00:00
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2022:3995-1)
2022-11-16 00:00:00
Debian: Security Advisory (DSA-5283-1)
2022-11-18 00:00:00
Mageia: Security Advisory (MGASA-2024-0069)
2024-03-18 00:00:00
gentoo
gentoo
FasterXML jackson-databind: Multiple vulnerabilities
2022-10-31 00:00:00
redhat
redhat
(RHSA-2023:0713) Important: Red Hat Data Grid 8.4.1 security update
2023-02-09 11:33:55
(RHSA-2022:9032) Important: Red Hat build of Eclipse Vert.x 4.3.4 security update
2022-12-15 12:38:08
(RHSA-2022:8958) Important: bcel security update
2022-12-13 13:48:23
mageia
mageia
Updated jackson-databind packages fix security vulnerabilities
2024-03-16 19:28:17
osv
osv
jackson-databind - security update
2022-11-17 00:00:00
jackson-databind - security update
2022-11-27 00:00:00
CVE-2022-25914
2022-09-08 05:15:07
debian
debian
[SECURITY] [DSA 5283-1] jackson-databind security update
2022-11-17 11:17:07
[SECURITY] [DLA 3207-1] jackson-databind security update
2022-11-27 18:53:52
nvd
nvd
CVE-2022-25914
2022-09-08 05:15:07
CVE-2022-37603
2022-10-14 16:15:12
CVE-2022-42920
2022-11-07 13:15:10
cve
cve
CVE-2022-25914
2022-09-08 05:15:07
CVE-2022-37603
2022-10-14 16:15:12
CVE-2022-42920
2022-11-07 13:15:10
redhatcve
redhatcve
CVE-2022-25914
2022-10-13 15:30:43
CVE-2022-37603
2022-11-07 10:56:15
CVE-2022-42920
2022-11-15 01:55:59
prion
prion
Remote code execution
2022-09-08 05:15:00
Denial of service
2022-10-14 16:15:00
Out-of-bounds
2022-11-07 13:15:00
veracode
veracode
Remote Code Execution
2022-09-09 04:27:17
Regular Expression Denial Of Service (ReDoS)
2022-10-16 21:39:10
Out-of-bound Write
2022-11-08 07:11:00
github
github
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
2022-10-14 19:00:38
com.google.cloud.tools:jib-core vulnerable to Remote Code Execution (RCE)
2022-09-09 00:00:57
Apache Commons BCEL vulnerable to out-of-bounds write
2022-11-07 19:00:22
cvelist
cvelist
CVE-2022-25914 Remote Code Execution (RCE)
2022-09-08 05:05:17
CVE-2022-37603
2022-10-14 00:00:00
CVE-2022-42920 Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
2022-11-07 00:00:00
debiancve
debiancve
CVE-2022-37603
2022-10-14 16:15:12
CVE-2022-42920
2022-11-07 13:15:10
CVE-2022-42004
2022-10-02 05:15:09
ubuntucve
ubuntucve
CVE-2022-37603
2022-10-14 00:00:00
CVE-2022-42920
2022-11-07 00:00:00
CVE-2022-42004
2022-10-02 00:00:00
rocky
rocky
bcel security update
2023-01-02 06:07:03
fedora
fedora
[SECURITY] Fedora 36 Update: bcel-6.4.1-10.fc36
2022-12-11 01:40:33
[SECURITY] Fedora 35 Update: bcel-6.4.1-10.fc35
2022-12-11 01:47:38
[SECURITY] Fedora 37 Update: bcel-6.5.0-3.fc37
2022-12-11 01:27:15
centos
centos
bcel security update
2023-07-27 14:36:35
redos
redos
ROS-20240806-03
2024-08-06 00:00:00
amazon
amazon
Important: bcel
2023-01-18 00:17:00
Important: bcel
2023-01-18 20:56:00
oraclelinux
oraclelinux
bcel security update
2022-12-14 00:00:00
bcel security update
2023-01-03 00:00:00
almalinux
almalinux
Important: bcel security update
2023-01-02 00:00:00
atlassian
atlassian
DoS (Denial of Service) com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server
2024-04-09 01:54:04
Deserialization com.fasterxml.jackson.core:jackson-databind in Jira Software Data Center and Server
2023-11-12 13:45:26
FasterXML Vulnerability in Bamboo Data Center and Server
2023-10-06 17:45:23
f5
f5
K000132725 : FasterXML vulnerability CVE-2022-42004
2023-03-22 00:00:00
K000135852 : FasterXML jackson-databind vulnerability CVE-2022-42003
2023-08-15 00:00:00
broadcom
broadcom
CVE-2022-42004 -In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur
2023-05-03 00:00:00
CVE-2022-42003 - In FasterXML jackson-databind before 2.14.0-rc1, ressource exhaustion
2023-05-03 00:00:00
cgr
cgr
CVE-2022-42004 vulnerabilities
2024-05-19 03:07:16
CVE-2022-42003 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2022-42004 vulnerabilities
2024-05-29 03:07:31

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.025

Percentile

90.1%

JSON
Related for RHSA-2023:0471
ibm57nessus34openvas15gentoo1redhat6mageia1osv17debian2nvd5cve5redhatcve5prion5veracode5github4cvelist4debiancve3ubuntucve4rocky1fedora3centos1redos1amazon2oraclelinux2almalinux1atlassian8f52broadcom2cgr2wolfi1