CVE-2022-42003 (High) detected in jackson-databind-2.9.10.4.jar, jackson-databind-2.10.0.jar - autoclosed #273
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
CVE-2022-42003 - High Severity Vulnerability
Vulnerable Libraries - jackson-databind-2.9.10.4.jar, jackson-databind-2.10.0.jar
jackson-databind-2.9.10.4.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /templates/sls-app-template-java/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.10.4/jackson-databind-2.9.10.4.jar
Dependency Hierarchy:
jackson-databind-2.10.0.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /templates/api-template-java/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar
Dependency Hierarchy:
Found in HEAD commit: 712665b267203375ee4b15e1f8d1ebe08abc1547
Found in base branch: develop
Vulnerability Details
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
Publish Date: 2022-10-02
URL: CVE-2022-42003
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-02
Fix Resolution: 2.12.7.1
⛑️ Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: