Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-sharedcachemanager/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Data Mapper package is a high-performance data binding package
built on Jackson JSON processor
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-timelineservice-hbase/hadoop-yarn-server-timelineservice-hbase-server/hadoop-yarn-server-timelineservice-hbase-server-1/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Data Mapper package is a high-performance data binding package
built on Jackson JSON processor
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-timelineservice-hbase/hadoop-yarn-server-timelineservice-hbase-server/hadoop-yarn-server-timelineservice-hbase-server-1/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Vulnerable Library - jersey-json-1.19.jar
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-sharedcachemanager/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-10202
### Vulnerable Library - jackson-mapper-asl-1.9.13.jarData Mapper package is a high-performance data binding package built on Jackson JSON processor
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-timelineservice-hbase/hadoop-yarn-server-timelineservice-hbase-server/hadoop-yarn-server-timelineservice-hbase-server-1/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jackson-mapper-asl-1.9.13.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsA series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
Publish Date: 2019-10-01
URL: CVE-2019-10202
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://lists.apache.org/thread/08302h5kp2l9ry2zq8vydomlhn0fg4j4
Release Date: 2019-10-01
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.0.0
CVE-2023-1436
### Vulnerable Library - jettison-1.1.jarA StAX implementation for JSON.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jettison-1.1.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsAn infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
Publish Date: 2023-03-22
URL: CVE-2023-1436
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-q6g2-g7f3-rr83
Release Date: 2023-03-22
Fix Resolution: org.codehaus.jettison:jettison:1.5.4
CVE-2022-45693
### Vulnerable Library - jettison-1.1.jarA StAX implementation for JSON.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jettison-1.1.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsJettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
Publish Date: 2022-12-13
URL: CVE-2022-45693
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-12-13
Fix Resolution: org.codehaus.jettison:jettison:1.5.2
CVE-2022-45685
### Vulnerable Library - jettison-1.1.jarA StAX implementation for JSON.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jettison-1.1.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsA stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.
Publish Date: 2022-12-13
URL: CVE-2022-45685
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-12-13
Fix Resolution: org.codehaus.jettison:jettison:1.5.2
CVE-2022-40150
### Vulnerable Library - jettison-1.1.jarA StAX implementation for JSON.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jettison-1.1.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsThose using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
Publish Date: 2022-09-16
URL: CVE-2022-40150
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-09-16
Fix Resolution: org.codehaus.jettison:jettison:1.5.1
CVE-2022-40149
### Vulnerable Library - jettison-1.1.jarA StAX implementation for JSON.
Path to dependency file: /hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar,/home/wss-scanner/.m2/repository/org/codehaus/jettison/jettison/1.1/jettison-1.1.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jettison-1.1.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsThose using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Publish Date: 2022-09-16
URL: CVE-2022-40149
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-09-16
Fix Resolution: org.codehaus.jettison:jettison:1.5.1
CVE-2019-10172
### Vulnerable Library - jackson-mapper-asl-1.9.13.jarData Mapper package is a high-performance data binding package built on Jackson JSON processor
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-timelineservice-hbase/hadoop-yarn-server-timelineservice-hbase-server/hadoop-yarn-server-timelineservice-hbase-server-1/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar,/home/wss-scanner/.m2/repository/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar
Dependency Hierarchy: - jersey-json-1.19.jar (Root Library) - :x: **jackson-mapper-asl-1.9.13.jar** (Vulnerable Library)
Found in HEAD commit: 470f1f88c503c0d5abfd3273f348b226d6b3cfbc
Found in base branch: hubspot-3.3
### Vulnerability DetailsA flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Publish Date: 2019-11-18
URL: CVE-2019-10172
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10172
Release Date: 2019-11-18
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.0.0-RC1