Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42004: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | jackson-databind | 0:2.11.4-6.amzn2023.0.3 |
Vulnerabilities 1
-
High 7.5
Uncontrolled Resource Consumption in FasterXML jackson-databind
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-42004.html