General data-binding functionality for Jackson: works on core streaming API
Language
JAVA
Vulnerability
Remote Code Execution (RCE) Through Deserialization
Vulnerability description
Jackson-databind is vulnerable to remote code execution (RCE) attacks. This is a follow-up similar attack of CVE-2017-7525. The attack is still possible because more dangerous classes were added in the later released versions and were not blacklisted.
Veracode Software Composition Analysis
Links: