Skip to content

Commit

Permalink
Merge pull request #182 from github/westonsteimel-GHSA-gww7-p5w4-wrfv
Browse files Browse the repository at this point in the history
  • Loading branch information
@advisory-database
advisory-database[bot] authored Apr 7, 2022
2 parents 87df754 + b79062d commit e546377
Showing 1 changed file with 30 additions and 122 deletions.
152 changes: 30 additions & 122 deletions advisories/github-reviewed/2020/03/GHSA-gww7-p5w4-wrfv/GHSA-gww7-p5w4-wrfv.json
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.2.0",
"id": "GHSA-gww7-p5w4-wrfv",
"modified": "2021-07-28T17:41:59Z",
"modified": "2022-04-06T23:36:40Z",
"published": "2020-03-04T20:52:11Z",
"aliases": [
"CVE-2019-20330"
],
"summary": "Deserialization of Untrusted Data in jackson-databind",
"details": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.",
"details": "FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.",
"severity": [
{
"type": "CVSS_V3",
Expand All @@ -26,120 +26,9 @@
"events": [
{
"introduced": "2.0.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.0.6"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.1.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.1.5"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.2.4"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.3.5"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.4.6.1"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.5.5"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.core:jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
},
{
"introduced": "2.6.0"
"fixed": "2.6.7.4"
}
]
}
Expand All @@ -159,6 +48,9 @@
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.9.7"
}
]
}
Expand Down Expand Up @@ -223,15 +115,23 @@
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2"
"url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.6.7.3...jackson-databind-2.6.7.4"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
"url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.7.9.6...jackson-databind-2.7.9.7"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
"url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.8.11.4...jackson-databind-2.8.11.5"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E"
},
{
"type": "WEB",
Expand Down Expand Up @@ -317,10 +217,6 @@
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b@%3Ccommits.druid.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99@%3Cissues.zookeeper.apache.org%3E"
Expand All @@ -341,9 +237,21 @@
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
}
],
"database_specific": {
Expand Down

0 comments on commit e546377

Please sign in to comment.