Red Hat Security Advisory: rh-eclipse46-jackson-databind security update

Fixed packages 2

Vulnerabilities 1

• Critical 9.8
  CVE-2017-15095

  jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

  A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This i…

  FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Feb 6, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1506612
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3190.json
• report
  https://access.redhat.com/security/cve/CVE-2017-15095
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15095
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15095
• article
  https://access.redhat.com/solutions/3442891