github_osv/GHSA-h592-38cm-4ggp
jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.
gitlab/maven/com.fasterxml.jackson.core/jackson-databind/CVE-2017-15095
Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the `readValue` method of the `ObjectMapper`.