GitStock

fasterxml/jackson-databind · Security

Deserialization of Untrusted Data in FasterXML jackson-databind

GHSA ID
GHSA-mph4-vhrx-mv67
CVE ID
CVE-2019-12384
Severity
medium
Published
Updated
CVSS
5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3
5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

CWEs

  • CWE-502 · Deserialization of Untrusted Data

References