Red Hat Security AdvisoryRHSA-2017:1840
devtoolset-4-jackson-databind security update
Released 2017-07-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) devtoolset-4-jackson-databind-2.5.0-2.4.el6, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) devtoolset-4-jackson-databind-2.5.0-2.4.el7, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) devtoolset-4-jackson-databind-2.5.0-2.4.el6, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) devtoolset-4-jackson-databind-2.5.0-2.4.el7, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) devtoolset-4-jackson-databind-2.5.0-2.4.el6, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) devtoolset-4-jackson-databind-2.5.0-2.4.el7, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el7
Fixes 1 record
Priority HIGH 75
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.37721 · Published 2018-02-06 · Partial fix · 2.6.7.1, 2.7.9.1 +1 CWE-184
