CVE-2021-46877

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode

Published Mar 18, 2023 CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Description
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-0856 jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Github GHSA Github GHSA GHSA-3x8x-79m2-3w2w jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00097}

epss

{'score': 0.00099}

Type Values Removed Values Added
First Time appeared Redhat satellite Maintenance
Redhat satellite Utils
CPEs cpe:/a:redhat:satellite_maintenance:6.13::el8
cpe:/a:redhat:satellite_utils:6.13::el8
Vendors & Products Redhat satellite Maintenance
Redhat satellite Utils
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}