~ / search / GHSA-mx9v-gmh4-mgqw

GHSA-mx9v-gmh4-mgqw

Deserialization of Untrusted Data in jackson-databind

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-19361

Packages

EcosystemPackageAffectedFixed in
Maven com.fasterxml.jackson.core:jackson-databind >= 2.7.0, < 2.7.9.5 2.7.9.5
Maven com.fasterxml.jackson.core:jackson-databind >= 2.9.0, < 2.9.8 2.9.8
Maven com.fasterxml.jackson.core:jackson-databind >= 2.8.0, < 2.8.11.3 2.8.11.3

Details

As written in the advisory (Markdown source, shown as plain text).

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

References

External links from the advisory. They lead to third-party sites.