Deserialization of Untrusted Data
High severity
GitHub Reviewed
Published
Jun 15, 2020
to the GitHub Advisory Database
•
Updated Mar 1, 2024
Package
Affected versions
>= 2.7.0, <= 2.7.9.3
>= 2.8.0, <= 2.8.11.1
>= 2.9.0, < 2.9.6
Patched versions
2.7.9.4
2.8.11.2
2.9.6
Description
Reviewed
Jun 11, 2020
Published to the GitHub Advisory Database
Jun 15, 2020
Last updated
Mar 1, 2024
Credits
-
sunSUNQ Analyst
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
References