Summary
jackson-core
[2.21.6-1]
- Rebase to version 2.21.6
- Resolves: RHEL-259227
jackson-databind
[2.21.6-1]
- Rebase to version 2.21.6
- Resolves: RHEL-259227
jackson-jaxrs-providers
[2.21.6-1]
- Rebase to version 2.21.6
- Resolves: RHEL-259227
jackson-modules-base
[2.21.6-1]
- Rebase to version 2.21.6
- Resolves: RHEL-259227
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | pki-jackson-core | 0:2.21.6-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-databind | 0:2.21.6-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-jaxrs-json-provider | 0:2.21.6-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-jaxrs-providers | 0:2.21.6-1.el9_8 |
| Oracle Linux · 9 | pki-jackson-module-jaxb-annotations | 0:2.21.6-1.el9_8 |
Vulnerabilities 1
-
High 7.5
jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._dese…