~ / search / GHSA-f3j5-rmmp-3fc5

GHSA-f3j5-rmmp-3fc5

Improper Input Validation in jackson-databind

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-17267

Packages

EcosystemPackageAffectedFixed in
Maven com.fasterxml.jackson.core:jackson-databind >= 2.9.0, < 2.9.10 2.9.10
Maven com.fasterxml.jackson.core:jackson-databind < 2.8.11.5 2.8.11.5

Details

As written in the advisory (Markdown source, shown as plain text).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

References

External links from the advisory. They lead to third-party sites.