diff --git a/advisories/github-reviewed/2019/08/GHSA-gwp4-hfv6-p7hw/GHSA-gwp4-hfv6-p7hw.json b/advisories/github-reviewed/2019/08/GHSA-gwp4-hfv6-p7hw/GHSA-gwp4-hfv6-p7hw.json index c9d32d6ff43..bda8d84e699 100644 --- a/advisories/github-reviewed/2019/08/GHSA-gwp4-hfv6-p7hw/GHSA-gwp4-hfv6-p7hw.json +++ b/advisories/github-reviewed/2019/08/GHSA-gwp4-hfv6-p7hw/GHSA-gwp4-hfv6-p7hw.json @@ -1,17 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gwp4-hfv6-p7hw", - "modified": "2023-03-06T20:47:19Z", + "modified": "2023-09-13T17:26:54Z", "published": "2019-08-01T19:18:06Z", "aliases": [ "CVE-2019-14439" ], "summary": "Deserialization of untrusted data in FasterXML jackson-databind", - "details": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.", + "details": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.14, 2.7.9.6, and 2.6.7.3. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.", "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "affected": [ @@ -20,6 +20,83 @@ "ecosystem": "Maven", "name": "com.fasterxml.jackson.core:jackson-databind" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.fasterxml.jackson.core:jackson-databind" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.fasterxml.jackson.core:jackson-databind" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7.0" + }, + { + "fixed": "2.7.9.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.fasterxml.jackson.core:jackson-databind" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -28,14 +105,11 @@ "introduced": "0" }, { - "fixed": "2.9.9.2" + "fixed": "2.6.7.3" } ] } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.9.9.1" - } + ] } ], "references": [ @@ -55,6 +129,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2019:3200" }, + { + "type": "PACKAGE", + "url": "https://github.com/FasterXML/jackson-databind" + }, { "type": "WEB", "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2"