Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/55001?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/55001?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2", "type": "maven", "namespace": "com.fasterxml.jackson.core", "name": "jackson-databind", "version": "2.7.9.2", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "2.7.9.3", "latest_non_vulnerable_version": "2.16.0", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40369?format=api", "vulnerability_id": "VCID-a7vm-mty5-9bhg", "summary": "jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass\nFasterXML jackson-databind allows unauthenticated remote code execution. This is exploitable by sending maliciously crafted JSON input to the `readValue` method of the `ObjectMapper`, bypassing a denylist that is ineffective if the Spring libraries are available in the classpath.", "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0116", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:0116" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0342", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:0342" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0478", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:0478" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0479", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:0479" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0480", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:0480" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0481", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:0481" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:1447", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:1447" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:1448", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:1448" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:1449", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:1449" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:1450", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:1450" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:1451", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:1451" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:2930", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:2930" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:1782", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:1782" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:1797", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:1797" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:2858", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:2858" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:3149", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:3149" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:3892", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:3892" }, { "reference_url": "https://github.com/FasterXML/jackson-databind", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/459107dccc9b3ea991af3e6ad0953e54b01ef7c1", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/459107dccc9b3ea991af3e6ad0953e54b01ef7c1" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/4f16f67ebd22c7522fdbb8a7eb87e3026a807d61", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/4f16f67ebd22c7522fdbb8a7eb87e3026a807d61" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/978798382ceb72229e5036aa1442943933d6d171", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/978798382ceb72229e5036aa1442943933d6d171" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/eb217dd0f87c5fb471e0668575644aa7eba9a3d3", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/eb217dd0f87c5fb471e0668575644aa7eba9a3d3" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/issues/1855", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/issues/1855" }, { "reference_url": "https://github.com/irsl/jackson-rce-via-spel", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/irsl/jackson-rce-via-spel" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20180201-0003", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20180201-0003" }, { "reference_url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us", "reference_id": "", "reference_type": "", "scores": [], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us" }, { "reference_url": "https://web.archive.org/web/20200927162225/http://www.securityfocus.com/archive/1/541652/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [], "url": "https://web.archive.org/web/20200927162225/http://www.securityfocus.com/archive/1/541652/100/0/threaded" }, { "reference_url": "https://www.debian.org/security/2018/dsa-4114", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.debian.org/security/2018/dsa-4114" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2020.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485", "reference_id": "CVE-2017-17485", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485" }, { "reference_url": "https://github.com/advisories/GHSA-rfx6-vp9g-rh7v", "reference_id": "GHSA-rfx6-vp9g-rh7v", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-rfx6-vp9g-rh7v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55001?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/54876?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8ec9-5qt4-duat" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/54881?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.4" } ], "aliases": [ "CVE-2017-17485", "GHSA-rfx6-vp9g-rh7v" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a7vm-mty5-9bhg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39382?format=api", "vulnerability_id": "VCID-tfky-edec-13gw", "summary": "Deserialization of Untrusted Data\nA deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the `readValue` method of the `ObjectMapper`.", "references": [ { "reference_url": "https://github.com/FasterXML/jackson-databind/issues/1680", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/issues/1680" }, { "reference_url": "https://github.com/FasterXML/jackson-databind/issues/1737", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/FasterXML/jackson-databind/issues/1737" }, { "reference_url": "http://www.securityfocus.com/bid/103880", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/103880" }, { "reference_url": "http://www.securitytracker.com/id/1039769", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securitytracker.com/id/1039769" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095", "reference_id": "CVE-2017-15095", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55001?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/55002?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.10", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/55003?format=api", "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1" } ], "aliases": [ "CVE-2017-15095" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tfky-edec-13gw" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2" }