CVE-2022-42003

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-42003
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42003.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-42003
Aliases
Downstream
Related
Published
2022-10-02T05:15:09.070Z
Modified
2026-03-15T22:44:28.558124Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAPSINGLEVALUE_ARRAYS feature is enabled.

References

Affected packages

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/fasterxml/jackson-databind
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea6f3d4b05dde564a1a5013dd34467d676072afa
Introduced
70c5dfbd52410d99d36181072711125ac5240a15
Fixed
19e6b6fbcfd4105dc6365928ebc2f07da61e78c5
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bfe08f8178f028a71bc25bf68a8f690d0e484d9e
Fixed
d78d00ee7b5245b93103fef3187f70543d67ca33
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.12.7.1"
        },
        {
            "introduced": "2.13.0"
        },
        {
            "fixed": "2.13.4.1"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.13.3"
        }
    ]
}

Affected versions

jackson-databind-2.*
jackson-databind-2.12.6
jackson-databind-2.12.6.1
jackson-databind-2.12.7
jackson-databind-2.13.0

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    }
]
vanir_signatures 
[
    {
        "target": {
            "function": "_parseDateFromArray",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-0186158a",
        "digest": {
            "function_hash": "55137452319108694706482285745217617530",
            "length": 662.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_parseDoublePrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-386e2b7a",
        "digest": {
            "function_hash": "47721020587547126202446523876033959038",
            "length": 1357.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_parseIntPrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-58353f7f",
        "digest": {
            "function_hash": "206540345752999551857275354278098542511",
            "length": 1280.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_parseFloatPrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-6953ec82",
        "digest": {
            "function_hash": "281275484382631426376540227810656326634",
            "length": 1352.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_parseBytePrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-79e8d198",
        "digest": {
            "function_hash": "135478626391291231095018157136329113765",
            "length": 1662.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_parseShortPrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-9718ec5c",
        "digest": {
            "function_hash": "223055644582907238639488940967862329779",
            "length": 1666.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_deserializeWrappedValue",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-ac1d1511",
        "digest": {
            "function_hash": "270913776082561270937780172546158092571",
            "length": 559.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "_parseLongPrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-ae52424e",
        "digest": {
            "function_hash": "192313351096101983191506739265478515641",
            "length": 1274.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-d4eba547",
        "digest": {
            "line_hashes": [
                "187511702417318075088615199580365123083",
                "171169106898272220752629563926196098962",
                "150150120888474060006439263453847607586",
                "278377087569584579382488064867174273902",
                "68485079210258809759924195753443066027",
                "150526317829052031114157955728720405051",
                "171050482290259180972106012076516879653",
                "55278627082560370506254892100768999380",
                "44635266750468391322160524947826223926",
                "52366394905964938253101698138283483707",
                "103608730656823114944539280483604385345",
                "107420883513953212602315834205907843964",
                "137096913219287255149862401980951293790",
                "52366394905964938253101698138283483707",
                "304921270989571588141271522900336433317",
                "316090080486845987421185064110993753952",
                "337369675000051409608881544398995394352",
                "52366394905964938253101698138283483707",
                "198468286742088697922062587192951955495",
                "135509450364336026895713661516662488364",
                "136750278881149792215341503933938893525",
                "52366394905964938253101698138283483707",
                "319148903488428736266780308179310066412",
                "131431545397128131509940293565692208685",
                "42231487023768064643392472225658318289",
                "52366394905964938253101698138283483707",
                "197510294261582691528402512321329507399",
                "139056194678482280507601557356524108982",
                "327097463320694303410555973016174405694",
                "52366394905964938253101698138283483707",
                "7370891766700987213773116432973083125",
                "284928217820157852072373395022562162415",
                "296742389320967241727525604209727486885",
                "52366394905964938253101698138283483707",
                "247463767653475068543991721634745355060",
                "209039258600155260051562415803609984341",
                "336807441345153426732241512838299090052",
                "144478078437557099183768286811152596338",
                "57109704126805064372356840063810054920",
                "82128203077953132336543396852093847974",
                "258288701301954296117428434822529221568",
                "286168596985988661043798144926634974261",
                "231627223105871444847306047842254007041",
                "21843859667944622968642714575778067374"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "_parseBooleanPrimitive",
            "file": "src/main/java/com/fasterxml/jackson/databind/deser/std/StdDeserializer.java"
        },
        "id": "CVE-2022-42003-eb276efa",
        "digest": {
            "function_hash": "205053904232140672784182435672520456004",
            "length": 1525.0
        },
        "source": "https://github.com/fasterxml/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42003.json"