GitStock

fasterxml/jackson-databind · Security

Deserialization of Untrusted Data in jackson-databind

GHSA ID
GHSA-qr7j-h6gg-jmgc
CVE ID
CVE-2018-11307
Severity
critical
Published
Updated
CVSS
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

CWEs

  • CWE-502 · Deserialization of Untrusted Data

References