Описание
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | not-affected | 2.9.7 |
| cosmic | ignored | end of life |
| devel | not-affected | 2.9.7 |
| disco | not-affected | 2.9.7 |
| eoan | not-affected | 2.9.7 |
| esm-apps/bionic | not-affected | 2.9.7 |
| esm-apps/focal | not-affected | 2.9.7 |
| esm-apps/jammy | not-affected | 2.9.7 |
| esm-apps/noble | not-affected | 2.9.7 |
| esm-apps/xenial | released | 2.4.2-3ubuntu0.1~esm2 |
Показывать по
Ссылки на источники
EPSS
7.5 High
CVSS2
10 Critical
CVSS3
Связанные уязвимости
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attacke ...
Server-Side Request Forgery (SSRF) in jackson-databind
Уязвимость библиотеки jackson-databind, связанная с недостаточной проверкой поступающих запросов, позволяющая нарушителю осуществить SSRF-атаку
EPSS
7.5 High
CVSS2
10 Critical
CVSS3