Fasterxml Jackson Databind vulnerabilities
85 vulnerabilities
Known vulnerabilities in Fasterxml Jackson Databind, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-19360chainguardeco-java-gradle-4.10+32
EPSS score10.60%
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.CVE-2018-19362chainguardeco-java-gradle-2.10+64EPSS score10.60%
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.CVE-2018-19361chainguardeco-java-gradle-4.10+32EPSS score10.60%
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.CVE-2018-11307chainguardeco-java-gradle-2.10+54EPSS score5.73%
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.CVE-2018-14721chainguardeco-java-gradle-4.10+32EPSS score10.46%
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.CVE-2018-14718chainguardeco-java-gradle-2.10+77EPSS score12.68%
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.CVE-2018-14719chainguardeco-java-gradle-2.10+71EPSS score9.68%
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.CVE-2018-14720chainguardeco-java-gradle-4.10+32EPSS score7.52%
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.CVE-2018-7489chainguardeco-java-gradle-2.10+53EPSS score19.78%
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.CVE-2018-5968chainguardeco-java-gradle-2.10+45EPSS score7.25%
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.CVE-2018-12023chainguardeco-java-gradle-4.10+26EPSS score8.87%
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.CVE-2018-12022chainguardeco-java-gradle-2.10+58EPSS score7.29%
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.CVE-2021-20190apachenifi+79EPSS score7.57%
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-46877chainguardcassandra-reaper+48EPSS score1.12%
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.CVE-2020-11620chainguardeco-java-gradle-4.10+48EPSS score5.73%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).CVE-2020-11619chainguardeco-java-gradle-4.10+51EPSS score3.68%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).CVE-2020-11111chainguardeco-java-gradle-4.10+55EPSS score3.58%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).CVE-2020-11112chainguardeco-java-gradle-4.10+61EPSS score3.64%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).CVE-2020-11113chainguardeco-java-gradle-4.10+62EPSS score6.28%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).CVE-2020-9547chainguardeco-java-gradle-2.10+86EPSS score18.38%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).