GitHub Advisoryadvisory · Maven

GHSA-5949-rw7g-wx7w Deserialization of untrusted data in jackson-databind

HIGH Published 2021-01-20 Modified 2024-03-15 Official page ↗
Aliases
CVE-2021-20190
Ecosystem
Maven
Packages
com.fasterxml.jackson.core:jackson-databind
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-01-20

Affected packages

• Maven com.fasterxml.jackson.core:jackson-databind: >= 2.7.0, < 2.9.10.7 → fixed in 2.9.10.7 • Maven com.fasterxml.jackson.core:jackson-databind: < 2.6.7.5 → fixed in 2.6.7.5

Description

A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Related

Alias · CVE (1)

  • CVE-2021-20190 A flaw was found in jackson-databind before 2.9.10.7. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References