search

shaundmorris / ddf

The Distributed Data Framework
Other
0 stars 0 forks source link

CVE-2018-14721 High Severity Vulnerability detected by WhiteSource #836

Closed mend-bolt-for-github[bot] closed 4 years ago

mend-bolt-for-github[bot] commented 5 years ago

CVE-2018-14721 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.5.jar, jackson-databind-2.9.6.jar

jackson-databind-2.9.5.jar

General data-binding functionality for Jackson: works on core streaming API

path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.5/jackson-databind-2.9.5.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy: - catalog-ui-search-2.14.0-SNAPSHOT.jar (Root Library) - tika-bundle-1.18.0_3.jar - :x: **jackson-databind-2.9.5.jar** (Vulnerable Library)
jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.6/jackson-databind-2.9.6.jar

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy: - camel-aws-2.22.1.jar (Root Library) - :x: **jackson-databind-2.9.6.jar** (Vulnerable Library)

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14721

CVSS 3 Score Details (10.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44?diff=unified#diff-98084d808198119d550a9211e128a16f

Release Date: 2018-08-16

Fix Resolution: Replace or update the following files: VERSION, BeanDeserializerFactory.java

Step up your Open Source Security Game with WhiteSource here

stale[bot] commented 4 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs within 7 days. Thank you for your contributions.