Debian Long Term Support / LTS Security Information / 2022 / Security Information -- DLA-3207-1 jackson-databind

Debian Security Advisory

DLA-3207-1 jackson-databind -- LTS security update

Date Reported:

27 Nov 2022

Affected Packages:

jackson-databind

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 1007109.
In Mitre's CVE dictionary: CVE-2020-36518, CVE-2022-42003, CVE-2022-42004.

More information:

Several flaws were discovered in jackson-databind, a fast and powerful JSON library for Java.

• CVE-2020-36518

  Java StackOverflow exception and denial of service via a large depth of nested objects.

• CVE-2022-42003

  In FasterXML jackson-databind resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

• CVE-2022-42004

  In FasterXML jackson-databind resource exhaustion can occur because of a lack of a check in BeanDeserializerBase.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

For Debian 10 buster, these problems have been fixed in version 2.9.8-3+deb10u4.

We recommend that you upgrade your jackson-databind packages.

For the detailed security status of jackson-databind please refer to its security tracker page at: https://security-tracker.debian.org/tracker/jackson-databind

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS