jackson-databind Deserialization of Untrusted Data vulnerability
High severity
GitHub Reviewed
Published
Mar 25, 2019
to the GitHub Advisory Database
•
Updated Mar 1, 2024
Package
Affected versions
>= 2.9.0, < 2.9.6
<= 2.7.9.3
>= 2.8.0, <= 2.8.11.1
Patched versions
2.9.6
2.7.9.4
2.8.11.2
Description
Published by the National Vulnerability Database
Mar 21, 2019
Published to the GitHub Advisory Database
Mar 25, 2019
Reviewed
Jun 16, 2020
Last updated
Mar 1, 2024
Credits
-
sunSUNQ Analyst
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
References