Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/57271?format=api",
    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3",
    "type": "maven",
    "namespace": "com.fasterxml.jackson.core",
    "name": "jackson-databind",
    "version": "2.8.11.3",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "2.8.11.4",
    "latest_non_vulnerable_version": "2.16.0",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41108?format=api",
            "vulnerability_id": "VCID-p52x-ese3-qkha",
            "summary": "Information Disclosure\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.",
            "references": [
                {
                    "reference_url": "https://github.com/FasterXML/jackson-databind/issues/2341",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/FasterXML/jackson-databind/issues/2341"
                },
                {
                    "reference_url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
                    "reference_id": "CVE-2019-12814",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/58097?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.4"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/58237?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9.1"
                }
            ],
            "aliases": [
                "CVE-2019-12814"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p52x-ese3-qkha"
        }
    ],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40570?format=api",
            "vulnerability_id": "VCID-18u1-9nc1-2feh",
            "summary": "Deserialization of Untrusted Data\nFasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.",
            "references": [
                {
                    "reference_url": "https://github.com/FasterXML/jackson-databind/issues/2186",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/FasterXML/jackson-databind/issues/2186"
                },
                {
                    "reference_url": "https://issues.apache.org/jira/browse/TINKERPOP-2121",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://issues.apache.org/jira/browse/TINKERPOP-2121"
                },
                {
                    "reference_url": "http://www.securityfocus.com/bid/107985",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "http://www.securityfocus.com/bid/107985"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360",
                    "reference_id": "CVE-2018-19360",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57270?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/54879?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-p52x-ese3-qkha"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57271?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-p52x-ese3-qkha"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57183?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8"
                }
            ],
            "aliases": [
                "CVE-2018-19360"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-18u1-9nc1-2feh"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40573?format=api",
            "vulnerability_id": "VCID-8mns-fyju-dqdr",
            "summary": "Deserialization of Untrusted Data\nFasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `openjpa` class from polymorphic deserialization.",
            "references": [
                {
                    "reference_url": "https://github.com/FasterXML/jackson-databind/issues/2186",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/FasterXML/jackson-databind/issues/2186"
                },
                {
                    "reference_url": "https://issues.apache.org/jira/browse/TINKERPOP-2121",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://issues.apache.org/jira/browse/TINKERPOP-2121"
                },
                {
                    "reference_url": "http://www.securityfocus.com/bid/107985",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "http://www.securityfocus.com/bid/107985"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361",
                    "reference_id": "CVE-2018-19361",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57270?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/54879?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-p52x-ese3-qkha"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57271?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-p52x-ese3-qkha"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57183?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8"
                }
            ],
            "aliases": [
                "CVE-2018-19361"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8mns-fyju-dqdr"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40569?format=api",
            "vulnerability_id": "VCID-d6ez-jva8-hyag",
            "summary": "Deserialization of Untrusted Data\nFasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `jboss-common-core` class from polymorphic deserialization.",
            "references": [
                {
                    "reference_url": "https://github.com/FasterXML/jackson-databind/issues/2186",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/FasterXML/jackson-databind/issues/2186"
                },
                {
                    "reference_url": "https://issues.apache.org/jira/browse/TINKERPOP-2121",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://issues.apache.org/jira/browse/TINKERPOP-2121"
                },
                {
                    "reference_url": "http://www.securityfocus.com/bid/107985",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "http://www.securityfocus.com/bid/107985"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362",
                    "reference_id": "CVE-2018-19362",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57270?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.6.7.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/54879?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-p52x-ese3-qkha"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.5"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57271?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-p52x-ese3-qkha"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3"
                },
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/57183?format=api",
                    "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.8"
                }
            ],
            "aliases": [
                "CVE-2018-19362"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-d6ez-jva8-hyag"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.11.3"
}