Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
Critical severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Feb 21, 2023
Package
Affected versions
<= 1.9.13
Patched versions
None
Description
Published by the National Vulnerability Database
Oct 1, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Feb 14, 2023
Last updated
Feb 21, 2023
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
References