GitHub Advisoryadvisory · Maven

GHSA-c27h-mcmw-48hv Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl

CRITICAL Published 2022-05-24 Modified 2023-02-14 Official page ↗

Aliases: CVE-2019-10202
Ecosystem: Maven
Packages: org.codehaus.jackson:jackson-mapper-asl
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-502
Reviewed: 2023-02-14

Affected packages

• Maven org.codehaus.jackson:jackson-mapper-asl: <= 1.9.13 (no fix yet)

Description

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Related

Alias · CVE (1)

CVE-2019-10202 A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. vulnerability

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References