codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| RedHat | codehaus | affected |
|
Configuration 1 [-]
| AND |
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Fuse 7.8.0 | |||
| codehaus | cpe:/a:redhat:jboss_fuse:7 | RHSA-2020:5568 | 2020-12-16T00:00:00Z |
| Red Hat JBoss EAP 7.2 | |||
| codehaus | cpe:/a:redhat:jboss_enterprise_application_platform:7.2 | RHSA-2019:2938 | 2019-09-30T00:00:00Z |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | |||
| eap7-codehaus-jackson-0:1.9.13-9.redhat_00006.1.el6eap | cpe:/a:redhat:jboss_enterprise_application_platform:7.2::el6 | RHSA-2019:2935 | 2019-10-01T00:00:00Z |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | |||
| eap7-codehaus-jackson-0:1.9.13-9.redhat_00006.1.el7eap | cpe:/a:redhat:jboss_enterprise_application_platform:7.2::el7 | RHSA-2019:2936 | 2019-10-01T00:00:00Z |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | |||
| eap7-codehaus-jackson-0:1.9.13-9.redhat_00006.1.el8eap | cpe:/a:redhat:jboss_enterprise_application_platform:7.2::el8 | RHSA-2019:2937 | 2019-10-01T00:00:00Z |
No data available yet.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2022-3473 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike. |
Github GHSA |
GHSA-c27h-mcmw-48hv | Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl |
No CVSS v4.0
This CVE is not in the KEV list.
Exploit prediction score: 5.2% (5.175% probability within 30 days)
Key SSVC decision points have not yet been added.
No history.