Описание
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| jackson-databind | fixed | 2.11.1-1 | package | |
| jackson-databind | fixed | 2.9.8-3+deb10u2 | buster | package |
| jackson-databind | fixed | 2.8.6-1+deb9u7 | stretch | package |
Примечания
https://github.com/FasterXML/jackson-databind/issues/2765
https://github.com/FasterXML/jackson-databind/commit/f6d9c664f6d481703138319f6a0f1fdbddb3a259
Starting from 2.10 series mitigated as Safe Default Typing is enabled by default
but still an issue when Default Typing is enabled.
EPSS
Связанные уязвимости
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Deserialization of untrusted data in Jackson Databind
Уязвимость компонента org.jsecurity библиотеки Jackson-databind проекта FasterXML, позволяющая нарушителю выполнить произвольный код
EPSS