search

amaybaum-local / vprofile-project3

0 stars 2 forks source link

jackson-databind-2.9.10.4.jar: 4 vulnerabilities (highest severity is: 8.1) reachable - autoclosed #3

Closed mend-local-app[bot] closed 1 year ago

mend-local-app[bot] commented 1 year ago
Vulnerable Library - jackson-databind-2.9.10.4.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.10.4/jackson-databind-2.9.10.4.jar

Found in HEAD commit: c67ac45c66717b1cad3c6b136fc60b1c8e545972

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jackson-databind version) Remediation Available Reachability
CVE-2020-14195 High 8.1 jackson-databind-2.9.10.4.jar Direct com.fasterxml.jackson.core:jackson-databind:2.9.10.5 ✅

CVE-2020-14060 High 8.1 jackson-databind-2.9.10.4.jar Direct com.fasterxml.jackson.core:jackson-databind:2.10.0 ✅

CVE-2020-14061 High 8.1 jackson-databind-2.9.10.4.jar Direct com.fasterxml.jackson.core:jackson-databind:2.10.0 ✅

CVE-2020-14062 High 8.1 jackson-databind-2.9.10.4.jar Direct com.fasterxml.jackson.core:jackson-databind:2.10.0 ✅

Details

CVE-2020-14195 ### Vulnerable Library - jackson-databind-2.9.10.4.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.10.4/jackson-databind-2.9.10.4.jar

Dependency Hierarchy: - :x: **jackson-databind-2.9.10.4.jar** (Vulnerable Library)

Found in HEAD commit: c67ac45c66717b1cad3c6b136fc60b1c8e545972

Found in base branch: vp-rem

### Reachability Analysis

This vulnerability is potentially used ``` com.visualpathit.account.validator.UserValidator (Application) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration$1 (Extension) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration (Extension) -> org.springframework.messaging.converter.MappingJackson2MessageConverter (Extension) -> com.fasterxml.jackson.databind.ObjectMapper (Extension) -> com.fasterxml.jackson.databind.deser.BeanDeserializerFactory (Extension) -> ❌ com.fasterxml.jackson.databind.jsontype.impl.SubTypeValidator (Vulnerable Component) ```

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Publish Date: 2020-06-16

URL: CVE-2020-14195

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14195

Release Date: 2020-06-16

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.5

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-14060 ### Vulnerable Library - jackson-databind-2.9.10.4.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.10.4/jackson-databind-2.9.10.4.jar

Dependency Hierarchy: - :x: **jackson-databind-2.9.10.4.jar** (Vulnerable Library)

Found in HEAD commit: c67ac45c66717b1cad3c6b136fc60b1c8e545972

Found in base branch: vp-rem

### Reachability Analysis

This vulnerability is potentially used ``` com.visualpathit.account.validator.UserValidator (Application) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration$1 (Extension) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration (Extension) -> org.springframework.messaging.converter.MappingJackson2MessageConverter (Extension) -> com.fasterxml.jackson.databind.ObjectMapper (Extension) -> com.fasterxml.jackson.databind.deser.BeanDeserializerFactory (Extension) -> ❌ com.fasterxml.jackson.databind.jsontype.impl.SubTypeValidator (Vulnerable Component) ```

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Publish Date: 2020-06-14

URL: CVE-2020-14060

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14060

Release Date: 2020-06-14

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-14061 ### Vulnerable Library - jackson-databind-2.9.10.4.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.10.4/jackson-databind-2.9.10.4.jar

Dependency Hierarchy: - :x: **jackson-databind-2.9.10.4.jar** (Vulnerable Library)

Found in HEAD commit: c67ac45c66717b1cad3c6b136fc60b1c8e545972

Found in base branch: vp-rem

### Reachability Analysis

This vulnerability is potentially used ``` com.visualpathit.account.validator.UserValidator (Application) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration$1 (Extension) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration (Extension) -> org.springframework.messaging.converter.MappingJackson2MessageConverter (Extension) -> com.fasterxml.jackson.databind.ObjectMapper (Extension) -> com.fasterxml.jackson.databind.deser.BeanDeserializerFactory (Extension) -> ❌ com.fasterxml.jackson.databind.jsontype.impl.SubTypeValidator (Vulnerable Component) ```

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Publish Date: 2020-06-14

URL: CVE-2020-14061

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14061

Release Date: 2020-06-14

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-14062 ### Vulnerable Library - jackson-databind-2.9.10.4.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.10.4/jackson-databind-2.9.10.4.jar

Dependency Hierarchy: - :x: **jackson-databind-2.9.10.4.jar** (Vulnerable Library)

Found in HEAD commit: c67ac45c66717b1cad3c6b136fc60b1c8e545972

Found in base branch: vp-rem

### Reachability Analysis

This vulnerability is potentially used ``` com.visualpathit.account.validator.UserValidator (Application) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration$1 (Extension) -> org.springframework.messaging.simp.config.AbstractMessageBrokerConfiguration (Extension) -> org.springframework.messaging.converter.MappingJackson2MessageConverter (Extension) -> com.fasterxml.jackson.databind.ObjectMapper (Extension) -> com.fasterxml.jackson.databind.deser.BeanDeserializerFactory (Extension) -> ❌ com.fasterxml.jackson.databind.jsontype.impl.SubTypeValidator (Vulnerable Component) ```

### Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Publish Date: 2020-06-14

URL: CVE-2020-14062

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14062

Release Date: 2020-06-14

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

:rescue_worker_helmet: Automatic Remediation is available for this issue

:rescue_worker_helmet: Automatic Remediation is available for this issue.

mend-local-app[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.