GHSA-3x8x-79m2-3w2w

Source

https://github.com/advisories/GHSA-3x8x-79m2-3w2w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3x8x-79m2-3w2w

Aliases

Related

Published

2023-03-19T00:30:25Z

Modified

2024-11-28T05:46:06.039357Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

Details

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Database specific

{
    "nvd_published_at": "2023-03-18T22:15:00Z",
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-20T21:14:14Z"
}

References

Affected packages

Maven / com.fasterxml.jackson.core:jackson-databind

Package

Name: com.fasterxml.jackson.core:jackson-databind; View open source insights on deps.dev
Purl: pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.10.0

Fixed

2.12.6

Affected versions

2.*

2.10.0

2.10.0.pr1

2.10.0.pr2

2.10.0.pr3

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.10.5.1

2.11.0.rc1

2.11.0

2.11.1

2.11.2

2.11.3

2.11.4

2.12.0-rc1

2.12.0-rc2

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.12.5

Maven / com.fasterxml.jackson.core:jackson-databind

Package

Name: com.fasterxml.jackson.core:jackson-databind; View open source insights on deps.dev
Purl: pkg:maven/com.fasterxml.jackson.core/jackson-databind