Описание
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | not-affected | 2.9.8-1 |
| cosmic | ignored | end of life |
| devel | not-affected | 2.9.8-1 |
| disco | not-affected | 2.9.8-1 |
| eoan | not-affected | 2.9.8-1 |
| esm-apps/bionic | not-affected | 2.9.8-1 |
| esm-apps/focal | not-affected | 2.9.8-1 |
| esm-apps/jammy | not-affected | 2.9.8-1 |
| esm-apps/noble | not-affected | 2.9.8-1 |
| esm-apps/xenial | released | 2.4.2-3ubuntu0.1~esm2 |
Показывать по
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2. ...
Deserialization of Untrusted Data in jackson-databind
Уязвимость библиотеки jackson-databind, связанная с недостатками механизма десериализации, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
7.5 High
CVSS2
9.8 Critical
CVSS3