Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2025:14126

Опубликовано: 08 сент. 2025
Источник: rocky
Оценка: Important

Описание

Important: pki-deps:10.6 security update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

  • com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError (CVE-2025-52999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Затронутые продукты

  • Rocky Linux 8

НаименованиеАрхитектураРелизRPM
apache-commons-collectionsnoarch10.module+el8.10.0+2052+1b0fb438apache-commons-collections-3.2.2-10.module+el8.10.0+2052+1b0fb438.noarch.rpm
apache-commons-collectionsnoarch10.module+el8.10.0+1763+c7c02164apache-commons-collections-3.2.2-10.module+el8.10.0+1763+c7c02164.noarch.rpm
apache-commons-collectionsnoarch10.module+el8.10.0+2052+1b0fb438apache-commons-collections-3.2.2-10.module+el8.10.0+2052+1b0fb438.noarch.rpm
apache-commons-collectionsnoarch10.module+el8.10.0+1763+c7c02164apache-commons-collections-3.2.2-10.module+el8.10.0+1763+c7c02164.noarch.rpm
bea-stax-apinoarch16.module+el8.10.0+1763+c7c02164bea-stax-api-1.2.0-16.module+el8.10.0+1763+c7c02164.noarch.rpm
apache-commons-langnoarch21.module+el8.10.0+1763+c7c02164apache-commons-lang-2.6-21.module+el8.10.0+1763+c7c02164.noarch.rpm
apache-commons-langnoarch21.module+el8.10.0+1763+c7c02164apache-commons-lang-2.6-21.module+el8.10.0+1763+c7c02164.noarch.rpm
apache-commons-netnoarch3.module+el8.10.0+2052+1b0fb438apache-commons-net-3.6-3.module+el8.10.0+2052+1b0fb438.noarch.rpm
apache-commons-netnoarch3.module+el8.10.0+1763+c7c02164apache-commons-net-3.6-3.module+el8.10.0+1763+c7c02164.noarch.rpm
apache-commons-netnoarch3.module+el8.10.0+2052+1b0fb438apache-commons-net-3.6-3.module+el8.10.0+2052+1b0fb438.noarch.rpm

Показывать по

Связанные CVE

Исправления

Связанные уязвимости

ubuntu
7 месяцев назад

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

CVSS3: 7.5
redhat
7 месяцев назад

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

nvd
7 месяцев назад

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

debian
7 месяцев назад

jackson-core contains core low-level incremental ("streaming") parser ...

rocky
3 месяца назад

Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update