GHSA-qxxx-2pp7-5hmxCriticalCVSS 9.8

jackson-databind is vulnerable to a deserialization flaw

Published
October 16, 2018
Last Modified
March 1, 2024

🔗 CVE IDs covered (1)

CVE-2017-7525 →

📋 Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

🎯 Affected products3

  • maven/com.fasterxml.jackson.core:jackson-databind:>= 2.8.0, < 2.8.9
  • maven/com.fasterxml.jackson.core:jackson-databind:<= 2.6.7.0
  • maven/com.fasterxml.jackson.core:jackson-databind:>= 2.7.0, <= 2.7.9.0

🔗 References (65)