Red Hat Security AdvisoryRHSA-2019:1820
rh-maven35-jackson-databind security update
Released 2019-07-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.6.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.6.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.6.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.6.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.6.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7
Fixes 1 record
Priority MEDIUM 62
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.45205 · Published 2019-06-24 · Partial fix · 2.9.9.1, 2.8.11.4 +2 CWE-502
