DSA-5283-1

Source
https://storage.googleapis.com/debian-osv/dsa-osv/DSA-5283-1.json
Aliases
Published
2022-11-17T00:00:00Z
Modified
2022-11-17T13:36:24.079343Z
Details

Several flaws were discovered in jackson-databind, a fast and powerful JSON library for Java.

  • CVE-2020-36518 Java StackOverflow exception and denial of service via a large depth of nested objects.
  • CVE-2022-42003 In FasterXML jackson-databind resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
  • CVE-2022-42004 In FasterXML jackson-databind resource exhaustion can occur because of a lack of a check in BeanDeserializerBase.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

For the stable distribution (bullseye), these problems have been fixed in version 2.12.1-1+deb11u1.

We recommend that you upgrade your jackson-databind packages.

For the detailed security status of jackson-databind please refer to its security tracker page at: \ https://security-tracker.debian.org/tracker/jackson-databind

References

Affected packages

Debian:11 / jackson-databind

jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0
Fixed
2.12.1-1+deb11u1

Affected versions

2.*

2.12.1-1