Polaris

com.fasterxml.jackson.core/jackson-databind

Back to Components
General data-binding functionality for Jackson: works on core streaming API
mavenlibrary

Overview

Canonical component data stored by Polaris.

Version

2.9.3

Package Manager

maven

Type

library

Systems

1

Licenses

No license information

Direct Dependencies

2

Technology

Not linked

External Signals
deps.dev endoflife.date OSV.dev
Package URL

pkg:maven/com.fasterxml.jackson.core/[email protected]?type=jar

Maintenance

Derived from available component and registry data

Aging
Confidence

Medium

Version Age

3162 days

Update Status

Minor update available

Recent Activity

Yes

Reasons
Very old versionMature versionMinor available

Lifecycle

Source: endoflife.date

Unknown
No lifecycle match available
The mapped product was not available from the third-party lifecycle source.
Open endoflife.date

Registry

Source: deps.dev

Available
Ecosystem

maven

Latest Version

2.18.9

Published

12/9/2017

Recent Releases

18

Advisories

69

Licenses
Apache-2.0
Advisory Links
GHSA-27xj-rqx5-2255GHSA-288c-cq4h-88gqGHSA-4gq5-ch57-c2mgGHSA-4w82-r329-3q67GHSA-57j2-w4cx-62h2GHSA-58pp-9c76-5625GHSA-5949-rw7g-wx7wGHSA-5jmj-h7xm-6q6vGHSA-5p34-5m6p-p58gGHSA-5r5r-6hpj-8gg9GHSA-5ww9-j83m-q7qxGHSA-645p-88qh-w398GHSA-6fpp-rgj9-8rwcGHSA-6wqp-v4v6-c87cGHSA-758m-v56v-grj4GHSA-85cw-hj65-qqv9GHSA-89qr-369f-5m5xGHSA-8c4j-34r4-xr8gGHSA-8w26-6f25-cm9xGHSA-95cm-88f5-f2c7GHSA-9gph-22xh-8x98GHSA-9m6f-7xcq-8vf8GHSA-9mxf-g3x6-wv74GHSA-9vvp-fxw6-jcxrGHSA-c265-37vj-cwccGHSA-c2q3-4qrh-fm48GHSA-c8hm-7hpq-7jhgGHSA-cf6r-3wgc-h863GHSA-cggj-fvv3-cqwvGHSA-cjjf-94ff-43w7GHSA-cmfg-87vq-g5g4GHSA-cvm9-fjm9-3572GHSA-f3j5-rmmp-3fc5GHSA-f9hv-mg5h-xcw9GHSA-f9xh-2qgp-cq57GHSA-fmmc-742q-jg75GHSA-fqwf-pjwf-7vqvGHSA-gjmw-vf9h-g25vGHSA-gwp4-hfv6-p7hwGHSA-gww7-p5w4-wrfvGHSA-h3cw-g4mq-c5x2GHSA-h4rc-386g-6m85GHSA-h592-38cm-4ggpGHSA-h822-r4r5-v8jgGHSA-hgj6-7826-r7m5GHSA-j823-4qch-3rgmGHSA-jjjh-jjxp-wpffGHSA-m6x4-97wx-4q27GHSA-mc6h-4qgp-37qhGHSA-mph4-vhrx-mv67GHSA-mx7p-6679-8g3qGHSA-mx9v-gmh4-mgqwGHSA-p43x-xfjf-5jhrGHSA-q93h-jc49-78ggGHSA-qjw2-hr98-qgfhGHSA-qmqc-x3r4-6v39GHSA-qr7j-h6gg-jmgcGHSA-r3gr-cxrf-hg25GHSA-r695-7vr9-jgc2GHSA-rf6r-2c4q-2vwgGHSA-rfx6-vp9g-rh7vGHSA-rgv9-q543-rqg4GHSA-rpr3-cw39-3pxhGHSA-v3xw-c963-f5hcGHSA-v585-23hc-c647GHSA-vfqx-33qm-g869GHSA-w3f4-3q6j-rh82GHSA-wh8g-3j2c-rqj5GHSA-x2w5-5m2g-7h5m
Open deps.dev

Known Vulnerabilities

Source: OSV.dev

69 found

GHSA-27xj-rqx5-2255

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-288c-cq4h-88gq

XML External Entity (XXE) Injection in Jackson Databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Versions
>= 2.6.0, before 2.6.7.4>= 2.7.0.0, before 2.9.10.7>= 2.10.0.0, before 2.10.5.1
Open advisory

GHSA-4gq5-ch57-c2mg

Arbitrary Code Execution in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.7>= 2.8.0, before 2.8.11.3>= 2.0.0, before 2.7.9.5
Open advisory

GHSA-4w82-r329-3q67

Deserialization of Untrusted Data in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.6.7.4>= 2.7.0, before 2.7.9.7>= 2.8.0, before 2.8.11.5 +1 more
Open advisory

GHSA-57j2-w4cx-62h2

Deeply nested json in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 2.13.0, before 2.13.2.1all versions before 2.12.6.1
Open advisory

GHSA-58pp-9c76-5625

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-5949-rw7g-wx7w

Deserialization of untrusted data in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.7all versions before 2.6.7.5
Open advisory

GHSA-5jmj-h7xm-6q6v

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Versions
>= 3.1.0, before 3.1.4>= 2.8.0, before 2.18.9>= 2.19.0, before 2.21.5 +1 more
Open advisory

GHSA-5p34-5m6p-p58g

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-5r5r-6hpj-8gg9

Serialization gadget exploit in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-5ww9-j83m-q7qx

Information exposure in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 2.9.0, before 2.9.9>= 2.8.0, before 2.8.11.4>= 2.7.0, before 2.7.9.6 +1 more
Open advisory

GHSA-645p-88qh-w398

Arbitrary Code Execution in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.7>= 2.8.0, before 2.8.11.3>= 2.7.0, before 2.7.9.5 +1 more
Open advisory

GHSA-6fpp-rgj9-8rwc

Deserialization of untrusted data in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.9.2>= 2.8.0, before 2.8.11.4all versions before 2.7.9.6
Open advisory

GHSA-6wqp-v4v6-c87c

Deserialization of Untrusted Data

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.7.9.4>= 2.8.0, before 2.8.11.2>= 2.9.0, before 2.9.6
Open advisory

GHSA-758m-v56v-grj4

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-85cw-hj65-qqv9

Polymorphic Typing issue in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10>= 2.7.0, before 2.8.11.5all versions before 2.6.7.3
Open advisory

GHSA-89qr-369f-5m5x

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.8>= 2.0.0, before 2.6.7.5
Open advisory

GHSA-8c4j-34r4-xr8g

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.8>= 2.0.0, before 2.6.7.5
Open advisory

GHSA-8w26-6f25-cm9x

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-95cm-88f5-f2c7

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-9gph-22xh-8x98

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.8>= 2.0.0, before 2.6.7.5
Open advisory

GHSA-9m6f-7xcq-8vf8

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.00, before 2.9.10.8>= 2.0.0, before 2.6.7.5
Open advisory

GHSA-9mxf-g3x6-wv74

Server-Side Request Forgery (SSRF) in jackson-databind

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.7>= 2.8.0, before 2.8.11.3>= 2.7.0, before 2.7.9.5
Open advisory

GHSA-9vvp-fxw6-jcxr

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-c265-37vj-cwcc

Deserialization of untrusted data in Jackson Databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.5
Open advisory

GHSA-c2q3-4qrh-fm48

Deserialization of untrusted data in Jackson Databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.5
Open advisory

GHSA-c8hm-7hpq-7jhg

com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.8>= 2.8.0, before 2.8.11.3>= 2.7.0, before 2.7.9.5 +1 more
Open advisory

GHSA-cf6r-3wgc-h863

Polymorphic deserialization of malicious object in jackson-databind

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
all versions before 2.6.7.3>= 2.7.0, before 2.8.11.5>= 2.9.0, before 2.9.10
Open advisory

GHSA-cggj-fvv3-cqwv

FasterXML jackson-databind allows unauthenticated remote code execution

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.8.0, before 2.8.11.1>= 2.9.0, before 2.9.5>= 2.7.0, before 2.7.9.3 +1 more
Open advisory

GHSA-cjjf-94ff-43w7

jackson-databind Deserialization of Untrusted Data vulnerability

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
all versions before 2.7.9.4>= 2.8.0, before 2.8.11.2>= 2.9.0, before 2.9.6
Open advisory

GHSA-cmfg-87vq-g5g4

Deserialization of untrusted data in FasterXML jackson-databind

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 2.9.0, before 2.9.9.1>= 2.8.0, before 2.8.11.4>= 2.7.0, before 2.7.9.6 +1 more
Open advisory

GHSA-cvm9-fjm9-3572

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.8>= 2.0.0, before 2.6.7.5
Open advisory

GHSA-f3j5-rmmp-3fc5

Improper Input Validation in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10all versions before 2.8.11.5
Open advisory

GHSA-f9hv-mg5h-xcw9

Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.8>= 2.8.0, before 2.8.11.3>= 2.7.0, before 2.7.9.5
Open advisory

GHSA-f9xh-2qgp-cq57

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.8>= 2.0.0, before 2.6.7.5
Open advisory

GHSA-fmmc-742q-jg75

jackson-databind polymorphic typing issue

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.1>= 2.7.0, before 2.8.11.5all versions before 2.6.7.3
Open advisory

GHSA-fqwf-pjwf-7vqv

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.4>= 2.0.0, before 2.6.7.4
Open advisory

GHSA-gjmw-vf9h-g25v

jackson-databind polymorphic typing issue

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.1>= 2.7.0, before 2.8.11.5all versions before 2.6.7.3
Open advisory

GHSA-gwp4-hfv6-p7hw

Deserialization of untrusted data in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 2.9.0, before 2.9.9.2>= 2.8.0, before 2.8.11.4>= 2.7.0, before 2.7.9.6 +1 more
Open advisory

GHSA-gww7-p5w4-wrfv

Deserialization of Untrusted Data in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.6.7.4>= 2.7.0, before 2.7.9.7>= 2.8.0, before 2.8.11.5 +1 more
Open advisory

GHSA-h3cw-g4mq-c5x2

Code Injection in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.6
Open advisory

GHSA-h4rc-386g-6m85

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-h592-38cm-4ggp

jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.8.0, before 2.8.11>= 2.9.0, before 2.9.4>= 2.0.0, before 2.6.7.3 +1 more
Open advisory

GHSA-h822-r4r5-v8jg

Polymorphic Typing issue in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10>= 2.7.0, before 2.8.11.5all versions before 2.6.7.3
Open advisory

GHSA-hgj6-7826-r7m5

jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Versions
>= 2.0.0, before 2.18.8>= 2.19.0, before 2.21.4>= 3.0.0, before 3.1.4
Open advisory

GHSA-j823-4qch-3rgm

Deserialization of untrusted data in Jackson Databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.5
Open advisory

GHSA-jjjh-jjxp-wpff

Uncontrolled Resource Consumption in Jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 2.4.0-rc1, before 2.12.7.1>= 2.13.0, before 2.13.4.2
Open advisory

GHSA-m6x4-97wx-4q27

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-mc6h-4qgp-37qh

Deserialization of untrusted data in Jackson Databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.5
Open advisory

GHSA-mph4-vhrx-mv67

Deserialization of Untrusted Data in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 2.9.0, before 2.9.9.1>= 2.8.0, before 2.8.11.4>= 2.7.0, before 2.7.9.6 +1 more
Open advisory

GHSA-mx7p-6679-8g3q

Polymorphic Typing in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.1>= 2.7.0, before 2.8.11.5>= 2.0.0, before 2.6.7.3
Open advisory

GHSA-mx9v-gmh4-mgqw

Deserialization of Untrusted Data in jackson-databind

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.7.9.5>= 2.9.0, before 2.9.8>= 2.8.0, before 2.8.11.3
Open advisory

GHSA-p43x-xfjf-5jhr

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4>= 2.8.0, before 2.8.11.6>= 2.0.0, before 2.7.9.7
Open advisory

GHSA-q93h-jc49-78gg

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4>= 2.8.0, before 2.8.11.6>= 2.0.0, before 2.7.9.7
Open advisory

GHSA-qjw2-hr98-qgfh

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0, before 2.6.7.5>= 2.7.0, before 2.9.10.6
Open advisory

GHSA-qmqc-x3r4-6v39

Polymorphic deserialization of malicious object in jackson-databind

HIGH
Affected Versions
>= 2.9.0, before 2.9.10
Open advisory

GHSA-qr7j-h6gg-jmgc

Deserialization of Untrusted Data in jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.7.9.4>= 2.8.0, before 2.8.11.2>= 2.9.0, before 2.9.6
Open advisory

GHSA-r3gr-cxrf-hg25

Serialization gadgets exploit in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-r695-7vr9-jgc2

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-rf6r-2c4q-2vwg

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-rfx6-vp9g-rh7v

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.4>= 2.8.0, before 2.8.11all versions before 2.7.9.2
Open advisory

GHSA-rgv9-q543-rqg4

Uncontrolled Resource Consumption in FasterXML jackson-databind

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 2.4.0-rc1, before 2.12.7.1>= 2.13.0, before 2.13.4
Open advisory

GHSA-rpr3-cw39-3pxh

jackson-databind vulnerable to unsafe deserialization

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
all versions before 2.9.10.4
Open advisory

GHSA-v3xw-c963-f5hc

jackson-databind mishandles the interaction between serialization gadgets and typing

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.10.4
Open advisory

GHSA-v585-23hc-c647

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-vfqx-33qm-g869

Unsafe Deserialization in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.7.0, before 2.9.10.8all versions before 2.6.7.5
Open advisory

GHSA-w3f4-3q6j-rh82

Deserialization of Untrusted Data in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.8.0, before 2.8.11.1>= 2.9.0, before 2.9.4all versions before 2.7.9.5
Open advisory

GHSA-wh8g-3j2c-rqj5

Serialization gadgets exploit in jackson-databind

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.0.0, before 2.9.10.8
Open advisory

GHSA-x2w5-5m2g-7h5m

XML External Entity Reference (XXE) in jackson-databind

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 2.9.0, before 2.9.7>= 2.8.0, before 2.8.11.3>= 2.7.0, before 2.7.9.5
Open advisory
Open OSV.dev

Security

Source: OpenSSF Scorecard

Unavailable
No security scorecard available
This component does not have a repository reference for OpenSSF Scorecard lookup.

Dependencies

2 direct dependencies

Global view