From 7669bf5fb399ee9074761ff8ed43b867df6d907a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 13 Sep 2023 18:31:36 +0000
Subject: [PATCH] Publish Advisories

GHSA-4gq5-ch57-c2mg
GHSA-cjjf-94ff-43w7
---
 .../GHSA-4gq5-ch57-c2mg.json                  | 27 ++++++++++++++-----
 .../GHSA-cjjf-94ff-43w7.json                  | 23 ++++++++++++++--
 2 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/advisories/github-reviewed/2019/01/GHSA-4gq5-ch57-c2mg/GHSA-4gq5-ch57-c2mg.json b/advisories/github-reviewed/2019/01/GHSA-4gq5-ch57-c2mg/GHSA-4gq5-ch57-c2mg.json
index 24964ced0df..3d07186bdeb 100644
--- a/advisories/github-reviewed/2019/01/GHSA-4gq5-ch57-c2mg/GHSA-4gq5-ch57-c2mg.json
+++ b/advisories/github-reviewed/2019/01/GHSA-4gq5-ch57-c2mg/GHSA-4gq5-ch57-c2mg.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4gq5-ch57-c2mg",
-  "modified": "2022-09-14T22:33:24Z",
+  "modified": "2023-09-13T18:31:09Z",
   "published": "2019-01-04T19:09:49Z",
   "aliases": [
     "CVE-2018-14719"
   ],
   "summary": "Arbitrary Code Execution in jackson-databind",
-  "details": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.",
+  "details": "FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -20,6 +20,11 @@
         "ecosystem": "Maven",
         "name": "com.fasterxml.jackson.core:jackson-databind"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -39,6 +44,11 @@
         "ecosystem": "Maven",
         "name": "com.fasterxml.jackson.core:jackson-databind"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -61,6 +71,11 @@
         "ecosystem": "Maven",
         "name": "com.fasterxml.jackson.core:jackson-databind"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -149,12 +164,12 @@
       "url": "https://access.redhat.com/errata/RHSA-2019:4037"
     },
     {
-      "type": "WEB",
-      "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7"
+      "type": "PACKAGE",
+      "url": "https://github.com/FasterXML/jackson-databind"
     },
     {
-      "type": "ADVISORY",
-      "url": "https://github.com/advisories/GHSA-4gq5-ch57-c2mg"
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7"
     },
     {
       "type": "WEB",
diff --git a/advisories/github-reviewed/2019/03/GHSA-cjjf-94ff-43w7/GHSA-cjjf-94ff-43w7.json b/advisories/github-reviewed/2019/03/GHSA-cjjf-94ff-43w7/GHSA-cjjf-94ff-43w7.json
index e4805eb83e4..59611987105 100644
--- a/advisories/github-reviewed/2019/03/GHSA-cjjf-94ff-43w7/GHSA-cjjf-94ff-43w7.json
+++ b/advisories/github-reviewed/2019/03/GHSA-cjjf-94ff-43w7/GHSA-cjjf-94ff-43w7.json
@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cjjf-94ff-43w7",
-  "modified": "2021-06-11T15:58:48Z",
+  "modified": "2023-09-13T18:29:43Z",
   "published": "2019-03-25T18:03:09Z",
   "aliases": [
     "CVE-2018-12022"
   ],
-  "summary": "High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind",
+  "summary": "jackson-databind Deserialization of Untrusted Data vulnerability",
   "details": "An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.",
   "severity": [
     {
@@ -20,6 +20,11 @@
         "ecosystem": "Maven",
         "name": "com.fasterxml.jackson.core:jackson-databind"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -42,6 +47,11 @@
         "ecosystem": "Maven",
         "name": "com.fasterxml.jackson.core:jackson-databind"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -64,6 +74,11 @@
         "ecosystem": "Maven",
         "name": "com.fasterxml.jackson.core:jackson-databind"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -168,6 +183,10 @@
       "type": "WEB",
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671098"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/FasterXML/jackson-databind"
+    },
     {
       "type": "ADVISORY",
       "url": "https://github.com/advisories/GHSA-cjjf-94ff-43w7"