You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
General data-binding functionality for Jackson: works on core streaming API
Path to vulnerable library: /tcizendesk.module/lib/jackson-databind-2.1.4.jar
Dependency Hierarchy:
❌ jackson-databind-2.1.4.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
mend-for-github.aaakk.us.kgbot
changed the title
CVE-2022-42004 (Medium) detected in jackson-databind-2.1.4.jar
CVE-2022-42004 (High) detected in jackson-databind-2.1.4.jar
Oct 5, 2022
CVE-2022-42004 - High Severity Vulnerability
Vulnerable Library - jackson-databind-2.1.4.jar
General data-binding functionality for Jackson: works on core streaming API
Path to vulnerable library: /tcizendesk.module/lib/jackson-databind-2.1.4.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Publish Date: 2022-10-02
URL: CVE-2022-42004
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.13.4
The text was updated successfully, but these errors were encountered: