Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
85 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Recommended action: Upgrade to 2.9.7, 2.8.11.3 or 2.7.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Recommended action: Upgrade to 2.9.7, 2.8.11.3 or 2.7.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Recommended action: Upgrade to 2.9.8, 2.8.11.3, 2.7.9.5 or 2.6.7.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Recommended action: Upgrade to 2.9.8, 2.8.11.3 or 2.7.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Recommended action: Upgrade to 2.9.8, 2.8.11.3 or 2.7.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Recommended action: Upgrade to 2.9.7, 2.8.11.3, 2.7.9.5 or 2.6.7.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Recommended action: Upgrade to 2.9.4, 2.8.11 or 2.7.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.
Recommended action: Upgrade to 2.9.4, 2.8.11, 2.7.9.2 or 2.6.7.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FasterXML jackson-databind before before 2.6.7.5, 2.7.x before 2.7.9.3, 2.8.x before 2.8.11.1, and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Recommended action: Upgrade to 2.9.5, 2.8.11.1, 2.7.9.3 or 2.6.7.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Recommended action: Upgrade to 2.8.9, 2.7.9.1 or 2.6.7.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.