CVE

GHSA-5949-rw7g-wx7w

Deserialization of untrusted data in jackson-databind

CVE

GHSA-5949-rw7g-wx7w

Deserialization of untrusted data in jackson-databind

A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Package Versions Affected

com.fasterxml.jackson.core:jackson-databind 2.7.1-1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.0-rc2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.5.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.10.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.9.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.0.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.7.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.10.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.7.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.2.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.5.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.11.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.3.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.0-rc3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.0.0-RC1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.5.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.5.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.0.pr2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.0.rc1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.5.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.1.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.7

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.8

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.2.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.11

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.10

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.0.pr4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.0-rc1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.0.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.2.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.11.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.0-rc3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.1.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.3.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.8

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.7.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.1.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.10.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.10

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.0.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.0-rc1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.0.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.6.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9.7

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.11.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.9.6

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.0.pr3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.0-rc4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.1.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.10.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.0.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.3.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.11.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.1.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.7

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.7.0-rc1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.9

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.10.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.3.0-rc1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.3.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.1.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.5.0-rc1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.3.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.7.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.2

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.4

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.6.0-rc3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.1.3

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.5

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.9.8

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.5.1

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.8.0

Available

Unavailable

com.fasterxml.jackson.core:jackson-databind 2.4.0-rc2

Available

Unavailable

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading

Detect compatible fix

Apply safe remediation

Fix with a single pull request

CVSS Version

8.1

3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1

3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Related Resources

No items found.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-20190, https://github.com/FasterXML/jackson-databind/issues/2854, https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88, https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a, https://bugzilla.redhat.com/show_bug.cgi?id=1916633, https://github.com/FasterXML/jackson-databind, https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E, https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html, https://security.netapp.com/advisory/ntap-20210219-0008, https://www.oracle.com//security-alerts/cpujul2021.html

Severity

8.1

CVSS Score

Basic Information

Ecosystem

Base CVSS

8.1

EPSS Probability

0.00404%

EPSS Percentile

0.60426%

Introduced Version

2.7.9.2,2.8.11,2.9.4,2.0.0-RC1,2.7.0-rc1,2.8.0.rc1,2.9.0.pr1

Fix Available

2.9.10.7,2.6.7.5

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.

Fix Without Upgrading

Get a Demo

Let's Patch It!

GHSA-5949-rw7g-wx7w