Debian Jackson-Databind vulnerabilities

CVE-2020-9547 [CRITICAL] CVE-2020-9547: jackson-databind - FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee... FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). Scope: local bookworm: resolved (fixed in 2.11.1-1) bullseye: resolved (fixed in 2.11.1-1) forky: resolved (fixed in 2.11.1-1) sid: resolved (fixed

CVE-2020-9548 [CRITICAL] CVE-2020-9548: jackson-databind - FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee... FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). Scope: local bookworm: resolved (fixed in 2.11.1-1) bullseye: resolved (fixed in 2.11.1-1) forky: resolved (fixed in 2.11.1-1) sid: resolved (fixed in 2.11.1-1) trixie: res

CVE-2020-10650 [HIGH] CVE-2020-10650: jackson-databind - A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It c... A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider. Scope: local bookworm: resolved (fixe

CVE-2017-17485 [CRITICAL] CVE-2017-17485: jackson-databind - FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthe... FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring librarie

CVE-2017-7525 [CRITICAL] CVE-2017-7525: jackson-databind - A deserialization flaw was discovered in the jackson-databind, versions before 2... A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. Scope: local bookworm: resolved (fixed in 2.9.1-1) bullseye: resolved (fixed in 2.9.1-1) forky:

CVE-2018-7489 [CRITICAL] CVE-2018-7489: jackson-databind - FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x befor... FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if

CVE-2019-14379 [CRITICAL] CVE-2019-14379: jackson-databind - SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles de... SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. Scope: local bookworm: resolved (fixed in 2.9.9.3-1) bullseye: resolved (fixed in 2.9.9.3-1) forky: resolved (fixed in 2.9.9.3

CVE-2018-14718 [CRITICAL] CVE-2018-14718: jackson-databind - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec... FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization. Scope: local bookworm: resolved (fixed in 2.9.8-1) bullseye: resolved (fixed in 2.9.8-1) forky: resolved (fixed in 2.9.8-1) sid: resolved (fixed in 2.9.8-1) trixie: resolv

CVE-2018-14719 [CRITICAL] CVE-2018-14719: jackson-databind - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec... FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization. Scope: local bookworm: resolved (fixed in 2.9.8-1) bullseye: resolved (fixed in 2.9.8-1) forky: resolved (fixed in 2.9.8-1) sid: resolved (fixed in

CVE-2020-8840 [CRITICAL] CVE-2020-8840: jackson-databind - FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JN... FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. Scope: local bookworm: resolved (fixed in 2.11.1-1) bullseye: resolved (fixed in 2.11.1-1) forky: resolved (fixed in 2.11.1-1) sid: resolved (fixed in 2.11.1-1) trixie: resolved (fixed in 2.11.1-1)

CVE-2019-12086 [HIGH] CVE-2019-12086: jackson-databind - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x befo... A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the vict

CVE-2017-15095 [CRITICAL] CVE-2017-15095: jackson-databind - A deserialization flaw was discovered in the jackson-databind in versions before... A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used mal

CVE-2019-14892 [CRITICAL] CVE-2019-14892: jackson-databind - A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 an... A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code. Scope: local bookworm: resolved (fixed in 2.10.0-1) bullseye: resolved (fixed in 2.

CVE-2019-14893 [CRITICAL] CVE-2019-14893: jackson-databind - A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.1... A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or

CVE-2019-16942 [CRITICAL] CVE-2019-16942: jackson-databind - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th... A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to ma

CVE-2019-17531 [CRITICAL] CVE-2019-17531: jackson-databind - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th... A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is poss

CVE-2018-14721 [CRITICAL] CVE-2018-14721: jackson-databind - FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to cond... FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization. Scope: local bookworm: resolved (fixed in 2.9.8-1) bullseye: resolved (fixed in 2.9.8-1) forky: resolved (fixed in 2.9.8-1) sid: resolved (fi

CVE-2019-16943 [CRITICAL] CVE-2019-16943: jackson-databind - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th... A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make th

CVE-2020-36179 [HIGH] CVE-2020-36179: jackson-databind - FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction betwee... FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. Scope: local bookworm: resolved (fixed in 2.12.1-1) bullseye: resolved (fixed in 2.12.1-1) forky: resolved (fixed in 2.12.1-1) sid: resolved (fixed in 2.12.1-1) trixie: res

CVE-2020-25649 [HIGH] CVE-2020-25649: jackson-databind - A flaw was found in FasterXML Jackson Databind, where it did not have entity exp... A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. Scope: local bookworm: resolved (fixed in 2.11.1-1) bullseye: resolved (fixed in 2.11.1-1) forky: resolved (fixed in 2.11.1