Skip to content
OpenAdvisories
High · 7.5 CVE-2021-46877 EUVD-2023-0856GHSA-3x8x-79m2-3w2w

jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

Published Mar 18, 2023 · Updated Feb 26, 2025 · Assigned by mitre

Package: cassandra-reaper Package: com.fasterxml.jackson.core:jackson-databind Package: jackson-databind Package: jackson-databind Package: management-api-for-apache-cassandra-5.0 Package: management-api-for-apache-cassandra-5.0-compat Package: scala-3.8 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jackson-databind 2.13.2.2-1 —
Debian 13 jackson-databind 2.13.2.2-1 —
Debian 12 jackson-databind 2.13.2.2-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS jackson-databind No fix yet —
Ubuntu 20.04 LTS jackson-databind No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 3.9.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite_operations 1.3.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-lint 5.0.8-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-runner +1 2.2.1-3.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansiblerole-foreman_scap_client 0.2.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 cjson 1.7.14-5.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 createrepo_c +3 0.20.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 dynflow-utils 1.6.3-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman +1 3.5.1.14-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202102220000-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-discovery-image 1:4.1.0-10.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-installer +1 1:3.5.2.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-proxy +1 3.5.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello +3 4.7.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello-certs-tools 2.9.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.9-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 libcomps +2 0.1.18-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 libdb-cxx 5.3.28-42.el8_4 RHSA-2023:2097
Red Hat Satellite Capsule 6 libsodium 1.0.17-3.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 libsolv +2 0.7.22-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 libwebsockets 2.4.2-2.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 mosquitto 2.0.14-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 pulpcore-selinux 1.3.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-agent 7.12.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.10-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.4.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppetlabs-stdlib 5.2.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppetserver 7.9.3-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiodns +1 3.0.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiofiles +1 22.1.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiohttp +1 3.8.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiohttp-xmlrpc +1 1.5.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aioredis +1 2.0.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiosignal +1 1.2.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ansible-builder +1 1.0.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-asgiref +1 3.5.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-async-lru +1 1.0.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-async-timeout +1 4.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-asyncio-throttle +1 1.0.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-attrs +1 21.4.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-backoff +1 2.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bindep +1 2.11.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bleach +1 3.3.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bleach-allowlist +1 1.0.3-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bracex +1 2.2.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-brotli +1 1.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cchardet +1 2.1.7-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-certifi +1 2020.6.20-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cffi +1 1.15.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-chardet +1 5.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-charset-normalizer +1 2.1.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-click +1 8.1.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-click-shell +1 2.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-colorama +1 0.4.4-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-commonmark +1 0.9.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-contextlib2 +1 21.6.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cryptography +1 3.4.8-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-daemon +1 2.3.1-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dataclasses +1 0.8-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dateutil +1 2.8.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-debian +1 0.1.43-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-defusedxml +1 0.7.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-deprecated +1 1.2.13-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-diff-match-patch +1 20200713-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-distro +1 1.7.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django +1 3.2.18-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-currentuser +1 0.5.3-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-filter +1 22.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-guid +1 3.3.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-import-export +1 2.8.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-lifecycle +1 1.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-djangorestframework +1 3.13.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-djangorestframework-queryfields +1 1.0.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-docutils +1 0.19-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-access-policy +1 1.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-nested-routers +1 0.93.4-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-spectacular +1 0.23.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dynaconf +1 3.1.9-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ecdsa +1 0.14.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-enrich +1 1.2.6-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-et-xmlfile +1 1.1.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-flake8 +1 3.9.2-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-frozenlist +1 1.3.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-future +1 0.18.2-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-galaxy-importer +1 0.4.5-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gitdb +1 4.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.26-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gnupg +1 0.5.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gunicorn +1 20.1.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-idna +1 3.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-idna-ssl +1 1.1.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-importlib-metadata +1 4.10.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-inflection +3 0.5.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-iniparse +1 0.4-35.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-jinja2 +1 3.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-jsonschema +1 4.9.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-lockfile +1 0.12.2-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-lxml +1 4.7.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markdown +1 3.3.6-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markuppy +1 1.14-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markupsafe +1 2.0.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-mccabe +1 0.6.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-multidict +1 6.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-naya +3 1.1.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-odfpy +1 1.4.1-6.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-openpyxl +1 3.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-packaging +1 21.3-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-parsley +1 1.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pbr +1 5.8.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pexpect +1 4.8.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-productmd +1 1.33-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-protobuf +1 4.21.6-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-psycopg2 +1 2.9.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ptyprocess +1 0.7.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-ansible +1 1:0.15.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-certguard +1 1.5.5-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-cli +1 0.14.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-container +1 2.14.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-deb +1 2.20.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-file +1 1.11.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-rpm +1 3.18.11-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulpcore +1 3.21.6-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyOpenSSL +1 19.1.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycairo +1 1.20.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycares +1 4.1.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycodestyle +1 2.7.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycparser +1 2.21-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycryptodomex +1 3.14.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyflakes +1 2.3.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygments +1 2.11.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygobject +1 1:3.40.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygtrie +1 2.5.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyjwkest +1 1.4.2-6.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyjwt +1 2.5.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyparsing +1 2.4.7-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyrsistent +1 0.18.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pytz +1 2022.2.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyyaml +1 5.4.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-qpid +1 1.37.0-1.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 python-redis +1 4.3.4-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-requests +1 2.28.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-requirements-parser +1 0.2.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-rhsm +1 1.19.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-rich +1 10.12.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ruamel-yaml +1 0.17.20-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ruamel-yaml-clib +1 0.2.6-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-schema +1 0.7.5-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-semantic-version +1 2.10.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-six +1 1.16.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-smmap +1 5.0.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-sqlparse +1 0.4.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-tablib +1 3.2.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-tenacity +1 7.0.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-toml +1 0.10.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-types-cryptography +1 3.3.23-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-typing-extensions +1 3.10.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-uritemplate +1 4.1.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-url-normalize +1 1.4.3-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-urllib3 +1 1.26.8-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-urlman +1 2.0.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-wcmatch +1 8.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-whitenoise +1 6.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-wrapt +1 1.14.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-xlrd +1 2.0.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-xlwt +1 1.3.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-yarl 1.7.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-zipp 3.4.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python2-qpid-qmf 1.39.0-7.el8amq RHSA-2023:2097
Red Hat Satellite Capsule 6 python2-saslwrapper 0.22-6.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python3-qpid-proton 0.33.0-4.el8 RHSA-2023:2097
Red Hat Single Sign On 7 rh-sso7-keycloak +1 18.0.9-1.redhat_00001.1.el7sso RHSA-2023:4920, RHSA-2023:4919, RHSA-2023:4918
Red Hat Ocp Tools 4 jenkins 2.387.3.1684911776-3.el8 RHSA-2023:3610, RHSA-2023:3299
Red Hat Ocp Tools 4 jenkins-2-plugins 4.12.1686649756-1.el8 RHSA-2023:3610, RHSA-2023:3299
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-jettison 1.5.4-1.redhat_00002.1.el7eap RHSA-2023:4507, RHSA-2023:4506, RHSA-2023:4505
Red Hat JBoss EAP 7 eap7-undertow 2.2.25-3.SP3_redhat_00001.1.el7eap RHSA-2023:4507, RHSA-2023:4506, RHSA-2023:4505
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.12-3.GA_redhat_00003.1.el7eap RHSA-2023:4507, RHSA-2023:4506, RHSA-2023:4505
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.12-3.GA_redhat_00003.1.el8eap RHSA-2023:4507, RHSA-2023:4506

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 jackson-databind 2.11.4-6.amzn2023.0.2 ALAS2023-2023-428

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cassandra-reaper 4.0.1-r1 —
Wolfi rolling management-api-for-apache-cassandra-5.0 +1 0.1.89-r0 —
Wolfi rolling scala-3.8 3.8.4-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.fasterxml.jackson.core:jackson-databind >= 2.10.0, < 2.12.6 2.12.6 GHSA-3x8x-79m2-3w2w
Maven com.fasterxml.jackson.core:jackson-databind >= 2.13.0, < 2.13.1 2.13.1 GHSA-3x8x-79m2-3w2w

Advisories 15

References