GHSA-5949-rw7g-wx7w
Deserialization of untrusted data in jackson-databind
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2021-20190
- Alias
- BIT-nifi-2021-20190
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · com.fasterxml.jackson.core:jackson-databind | introduced 2.7.0, fixed 2.9.10.7 |
| Maven · com.fasterxml.jackson.core:jackson-databind | introduced 0, fixed 2.6.7.5 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2021-20190 ADVISORY
- https://github.com/FasterXML/jackson-databind/issues/2854 WEB
- https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88 WEB
- https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1916633 WEB
- https://github.com/FasterXML/jackson-databind PACKAGE
- https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E WEB
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html WEB
- https://security.netapp.com/advisory/ntap-20210219-0008 WEB
- https://www.oracle.com//security-alerts/cpujul2021.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |