Debian Security Advisory
DLA-2153-1 jackson-databind -- LTS security update
- Date Reported:
- 22 Mar 2020
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2020-10672, CVE-2020-10673.
- More information:
The following CVE(s) were reported against jackson-databind.
FasterXML jackson-databind 2.x before 220.127.116.11 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
FasterXML jackson-databind 2.x before 18.104.22.168 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
For Debian 8
Jessie, these problems have been fixed in version 2.4.2-2+deb8u13.
We recommend that you upgrade your jackson-databind packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS