Описание
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| jackson-databind | fixed | 2.11.1-1 | package | |
| jackson-databind | fixed | 2.9.8-3+deb10u2 | buster | package |
| jackson-databind | fixed | 2.8.6-1+deb9u7 | stretch | package |
Примечания
https://github.com/FasterXML/jackson-databind/issues/2620
https://github.com/FasterXML/jackson-databind/commit/914e7c9f2cb8ce66724bf26a72adc7e958992497
Starting from 2.10 series mitigated as Safe Default Typing is enabled by default
but still an issue when Default Typing is enabled.
EPSS
Связанные уязвимости
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Deserialization of Untrusted Data in jackson-databind
Уязвимость компонента xbean-reflect/JNDI библиотеки Jackson-databind, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS