Open mend-bolt-for-github[bot] opened 5 years ago
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /tmp/ws-scm/cleverdrawer/app/build.gradle
Path to vulnerable library: /cleverdrawer/app/build.gradle
Dependency Hierarchy: - :x: **jackson-databind-2.9.2.jar** (Vulnerable Library)
Found in HEAD commit: 67044a156fb55944e6625d0ea66d9212b8945968
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Publish Date: 2019-01-02
URL: CVE-2018-14721
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Change files
Origin: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
Release Date: 2018-08-16
Fix Resolution: Replace or update the following files: VERSION, BeanDeserializerFactory.java
Step up your Open Source Security Game with WhiteSource here
CVE-2018-14721 - High Severity Vulnerability
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /tmp/ws-scm/cleverdrawer/app/build.gradle
Path to vulnerable library: /cleverdrawer/app/build.gradle
Dependency Hierarchy: - :x: **jackson-databind-2.9.2.jar** (Vulnerable Library)
Found in HEAD commit: 67044a156fb55944e6625d0ea66d9212b8945968
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Publish Date: 2019-01-02
URL: CVE-2018-14721
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Change files
Origin: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
Release Date: 2018-08-16
Fix Resolution: Replace or update the following files: VERSION, BeanDeserializerFactory.java
Step up your Open Source Security Game with WhiteSource here