CVE-2022-42003

jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS

Published Oct 2, 2022 CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Description
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3207-1 jackson-databind security update
Debian DSA Debian DSA DSA-5283-1 jackson-databind security update
Github GHSA Github GHSA GHSA-jjjh-jjxp-wpff Uncontrolled Resource Consumption in Jackson-databind
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat satellite Maintenance
Redhat satellite Utils
CPEs cpe:/a:redhat:satellite_maintenance:6.11::el7
cpe:/a:redhat:satellite_maintenance:6.11::el8
cpe:/a:redhat:satellite_maintenance:6.12::el8
cpe:/a:redhat:satellite_utils:6.11::el7
cpe:/a:redhat:satellite_utils:6.11::el8
cpe:/a:redhat:satellite_utils:6.12::el8
Vendors & Products Redhat satellite Maintenance
Redhat satellite Utils
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus