Red Hat Security AdvisoryRHSA-2020:2320
rh-maven35-jackson-databind security update
Released 2020-05-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.10.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.10.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.10.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.10.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-maven35-jackson-databind-2.7.6-2.10.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.10.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.10.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.10.el7
Fixes 2 records
Priority MEDIUM 52
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.05733 · Published 2020-04-07 · Partial fix · 2.9.10.4 CWE-502
Priority MEDIUM 50
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.03683 · Published 2020-04-07 · Partial fix · 2.9.10.4 CWE-502
