Описание
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Отчет
Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle axis2-jaxws jar. Red Hat Virtualization is not affected by this issue, since its does not bundle axis2-jaxws jar.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | jackson-databind | Will not fix | ||
| Red Hat Enterprise Linux 8 | jackson-databind | Not affected | ||
| Red Hat JBoss A-MQ 6 | jackson-databind | Out of support scope | ||
| Red Hat JBoss BRMS 6 | jackson-databind | Will not fix | ||
| Red Hat JBoss Data Virtualization 6 | jackson-databind | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 6 | jackson-databind | Not affected | ||
| Red Hat JBoss Fuse 6 | jackson-databind | Will not fix | ||
| Red Hat JBoss Fuse Integration Service 2 | jackson-databind | Will not fix | ||
| Red Hat JBoss Operations Network 3 | Core Server | Not affected | ||
| Red Hat Mobile Application Platform 4 | jackson-databind | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attacke ...
Server-Side Request Forgery (SSRF) in jackson-databind
Уязвимость библиотеки jackson-databind, связанная с недостаточной проверкой поступающих запросов, позволяющая нарушителю осуществить SSRF-атаку
EPSS
6.8 Medium
CVSS3