Description
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-dataformat-xml | 2.8.5-1 | — |
| Debian 13 | jackson-dataformat-xml | 2.8.5-1 | — |
| Debian 12 | jackson-dataformat-xml | 2.8.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jackson-dataformat-xml | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.dataformat:jackson-dataformat-xml | < 2.7.8 | 2.7.8 | GHSA-7c2r-3jqf-c9rw |
| Maven | com.fasterxml.jackson.dataformat:jackson-dataformat-xml | >= 2.8.0, < 2.8.4 | 2.8.4 | GHSA-7c2r-3jqf-c9rw |