GHSA-89qr-369f-5m5x

Source

https://github.com/advisories/GHSA-89qr-369f-5m5x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-89qr-369f-5m5x/GHSA-89qr-369f-5m5x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-89qr-369f-5m5x

Aliases

CVE-2020-36182

Published

2021-12-09T19:15:46Z

Modified

2024-02-18T05:37:27.581808Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Unsafe Deserialization in jackson-databind

Details

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-18T23:37:58Z",
    "severity": "HIGH",
    "nvd_published_at": "2021-01-07T00:15:00Z",
    "cwe_ids": [
        "CWE-502"
    ]
}

References

Affected packages

Maven / com.fasterxml.jackson.core:jackson-databind

Package

Name: com.fasterxml.jackson.core:jackson-databind; View open source insights on deps.dev
Purl: pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.7.0

Fixed

2.9.10.8

Affected versions

2.*

2.7.0

2.7.1

2.7.1-1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.7.7

2.7.8

2.7.9

2.7.9.1

2.7.9.2

2.7.9.3

2.7.9.4

2.7.9.5

2.7.9.6

2.7.9.7

2.8.0.rc1

2.8.0.rc2

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.8.5

2.8.6

2.8.7

2.8.8

2.8.8.1

2.8.9

2.8.10

2.8.11

2.8.11.1

2.8.11.2

2.8.11.3

2.8.11.4

2.8.11.5

2.8.11.6

2.9.0

2.9.0.pr1

2.9.0.pr2

2.9.0.pr3

2.9.0.pr4

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.9.6

2.9.7

2.9.8

2.9.9

2.9.9.1

2.9.9.2

2.9.9.3

2.9.10

2.9.10.1

2.9.10.2

2.9.10.3

2.9.10.4

2.9.10.5

2.9.10.6

2.9.10.7

Maven / com.fasterxml.jackson.core:jackson-databind

Package

Name: com.fasterxml.jackson.core:jackson-databind; View open source insights on deps.dev
Purl: pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.6.7.5

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.4

2.0.5

2.0.6

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.2.0-rc1

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.3.0-rc1

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.4.0-rc1

2.4.0-rc2

2.4.0-rc3

2.4.0

2.4.1

2.4.1.1

2.4.1.2

2.4.1.3

2.4.2

2.4.3

2.4.4

2.4.5

2.4.5.1

2.4.6

2.4.6.1

2.5.0-rc1

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.6.0-rc1

2.6.0-rc2

2.6.0-rc3

2.6.0-rc4

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.7.1

2.6.7.2

2.6.7.3

2.6.7.4