netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4gq5-ch57-c2mg
GHSA-cjjf-94ff-43w7
This commit is contained in:
advisory-database[bot]
2023-09-13 18:31:36 +00:00
parent 1cbb04eb93
commit 7669bf5fb3
2 changed files with 42 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2019/01/GHSA-4gq5-ch57-c2mg/GHSA-4gq5-ch57-c2mg.json
+21 -6
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gq5-ch57-c2mg",
"modified": "2022-09-14T22:33:24Z",
"modified": "2023-09-13T18:31:09Z",
"published": "2019-01-04T19:09:49Z",
"aliases": [
"CVE-2018-14719"
],
"summary": "Arbitrary Code Execution in jackson-databind",
"details": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.",
"details": "FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.",
"severity": [
{
"type": "CVSS_V3",
@@ -20,6 +20,11 @@
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -39,6 +44,11 @@
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -61,6 +71,11 @@
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -149,12 +164,12 @@
"url": "https://access.redhat.com/errata/RHSA-2019:4037"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7"
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4gq5-ch57-c2mg"
"type": "WEB",
"url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7"
},
{
"type": "WEB",
advisories/github-reviewed/2019/03/GHSA-cjjf-94ff-43w7/GHSA-cjjf-94ff-43w7.json
+21 -2
View File
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cjjf-94ff-43w7",
"modified": "2021-06-11T15:58:48Z",
"modified": "2023-09-13T18:29:43Z",
"published": "2019-03-25T18:03:09Z",
"aliases": [
"CVE-2018-12022"
],
"summary": "High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind",
"summary": "jackson-databind Deserialization of Untrusted Data vulnerability",
"details": "An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.",
"severity": [
{
@@ -20,6 +20,11 @@
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -42,6 +47,11 @@
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -64,6 +74,11 @@
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -168,6 +183,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671098"
},
{
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-cjjf-94ff-43w7"