Search for packages
| purl | pkg:deb/debian/jackson-databind@2.9.8-1?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-2x39-rsxh-rkgw | Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `jboss-common-core` class from polymorphic deserialization. |
CVE-2018-19362
GHSA-c8hm-7hpq-7jhg |
| VCID-5r6v-ej7d-ubgv | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. |
CVE-2018-12022
GHSA-cjjf-94ff-43w7 |
| VCID-6zee-aqcc-vfbp | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6. |
CVE-2018-11307
GHSA-qr7j-h6gg-jmgc |
| VCID-75mz-c1ds-vqed | Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the `slf4j-ext` class from polymorphic deserialization. |
CVE-2018-14718
GHSA-645p-88qh-w398 |
| VCID-fafy-ugq3-cfbn | Server-Side Request Forgery (SSRF) FasterXML jackson-databind might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the `axis2-jaxws` class from polymorphic deserialization. |
CVE-2018-14721
GHSA-9mxf-g3x6-wv74 |
| VCID-g6up-yqg8-nbep | Deserialization of Untrusted Data FasterXML jackson-databind might allow remote attackers to execute arbitrary code by leveraging failure to block the `blaze-ds-opt` and `blaze-ds-core` classes from polymorphic deserialization. |
CVE-2018-14719
GHSA-4gq5-ch57-c2mg |
| VCID-g8gt-d7gz-13e6 | Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. |
CVE-2018-19360
GHSA-f9hv-mg5h-xcw9 |
| VCID-m7jp-7n22-4qg8 | Deserialization of Untrusted Data FasterXML jackson-databind might allow attackers to have unspecified impact by leveraging failure to block the `openjpa` class from polymorphic deserialization. |
CVE-2018-19361
GHSA-mx9v-gmh4-mgqw |
| VCID-sw29-epz3-g7ep | Improper Restriction of XML External Entity Reference FasterXML jackson-databind might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. |
CVE-2018-14720
GHSA-x2w5-5m2g-7h5m |
| VCID-zdwv-ycey-myfc | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. |
CVE-2018-12023
GHSA-6wqp-v4v6-c87c |