diff --git a/advisories/github-reviewed/2020/03/GHSA-gww7-p5w4-wrfv/GHSA-gww7-p5w4-wrfv.json b/advisories/github-reviewed/2020/03/GHSA-gww7-p5w4-wrfv/GHSA-gww7-p5w4-wrfv.json index 8b79ec908826e2..289cf32f4bb55a 100644 --- a/advisories/github-reviewed/2020/03/GHSA-gww7-p5w4-wrfv/GHSA-gww7-p5w4-wrfv.json +++ b/advisories/github-reviewed/2020/03/GHSA-gww7-p5w4-wrfv/GHSA-gww7-p5w4-wrfv.json @@ -1,13 +1,13 @@ { "schema_version": "1.2.0", "id": "GHSA-gww7-p5w4-wrfv", - "modified": "2021-07-28T17:41:59Z", + "modified": "2022-04-06T23:36:40Z", "published": "2020-03-04T20:52:11Z", "aliases": [ "CVE-2019-20330" ], "summary": "Deserialization of Untrusted Data in jackson-databind", - "details": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.", + "details": "FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.", "severity": [ { "type": "CVSS_V3", @@ -26,120 +26,9 @@ "events": [ { "introduced": "2.0.0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.0.6" - } - }, - { - "package": { - "ecosystem": "Maven", - "name": "com.fasterxml.jackson.core:jackson-databind" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.1.0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.1.5" - } - }, - { - "package": { - "ecosystem": "Maven", - "name": "com.fasterxml.jackson.core:jackson-databind" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.2.0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.2.4" - } - }, - { - "package": { - "ecosystem": "Maven", - "name": "com.fasterxml.jackson.core:jackson-databind" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.3.0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.3.5" - } - }, - { - "package": { - "ecosystem": "Maven", - "name": "com.fasterxml.jackson.core:jackson-databind" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.4.0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.4.6.1" - } - }, - { - "package": { - "ecosystem": "Maven", - "name": "com.fasterxml.jackson.core:jackson-databind" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "2.5.0" - } - ] - } - ], - "database_specific": { - "last_known_affected_version_range": "<= 2.5.5" - } - }, - { - "package": { - "ecosystem": "Maven", - "name": "com.fasterxml.jackson.core:jackson-databind" - }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ + }, { - "introduced": "2.6.0" + "fixed": "2.6.7.4" } ] } @@ -159,6 +48,9 @@ "events": [ { "introduced": "2.7.0" + }, + { + "fixed": "2.7.9.7" } ] } @@ -223,15 +115,23 @@ }, { "type": "WEB", - "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2" + "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.6.7.3...jackson-databind-2.6.7.4" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E" + "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.7.9.6...jackson-databind-2.7.9.7" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E" + "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.8.11.4...jackson-databind-2.8.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E" }, { "type": "WEB", @@ -317,10 +217,6 @@ "type": "WEB", "url": "https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b@%3Ccommits.druid.apache.org%3E" }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E" - }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99@%3Cissues.zookeeper.apache.org%3E" @@ -341,9 +237,21 @@ "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E" + }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/FasterXML/jackson-databind" } ], "database_specific": {