Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 10 | jackson-databind | 2.9.8-3+deb10u4 |
Vulnerabilities 3
-
High 7.5CVE-2020-36518 Public exploit
Deeply nested json in jackson-databind
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
-
High 7.5
Uncontrolled Resource Consumption in Jackson-databind
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
-
High 7.5
Uncontrolled Resource Consumption in FasterXML jackson-databind
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…