Red Hat Security AdvisoryRHSA-2019:0782
rh-maven35-jackson-databind security update
Released 2019-04-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
Fixes 10 records
Priority MEDIUM 63
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.12679 · Published 2019-01-02 · Partial fix · 2.9.7, 2.8.11.3 +2 CWE-502
Priority MEDIUM 61
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.09682 · Published 2019-01-02 · Partial fix · 2.9.7, 2.8.11.3 +1 CWE-502
Priority MEDIUM 57
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0573 · Published 2019-07-09 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 56
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVSS 3.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.10458 · Published 2019-01-02 · Partial fix · 2.9.7, 2.8.11.3 +1 CWE-918
Priority MEDIUM 55
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10599 · Published 2019-01-02 · Partial fix · 2.9.8, 2.8.11.3 +2 CWE-502
Priority MEDIUM 55
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10599 · Published 2019-01-02 · Partial fix · 2.7.9.5, 2.9.8 +1 CWE-502
Priority MEDIUM 55
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10599 · Published 2019-01-02 · Partial fix · 2.9.8, 2.8.11.3 +1 CWE-502
Priority MEDIUM 52
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07524 · Published 2019-01-02 · Partial fix · 2.9.7, 2.8.11.3 +1 CWE-502
Priority MEDIUM 45
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.07289 · Published 2019-03-17 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
Priority MEDIUM 44
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS 3.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.08872 · Published 2019-03-17 · Partial fix · 2.7.9.4, 2.8.11.2 +1 CWE-502
THREATIST.IORead the docs