Vulnerability/
REDHAT-BUG-2135244

REDHAT-BUG-2135244

Published Oct 17, 2022

Updated

In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1 https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 https://github.com/FasterXML/jackson-databind/issues/3590

Affected Software

3 affected components

fasterxml jackson-databind<2.14.0-rc1

fasterxml jackson-databind>2.13.4

fasterxml jackson-databind>2.12.17

Event History

Oct 17, 2022

Data Sourced

via Red Hat·06:54 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2135244?

The severity of REDHAT-BUG-2135244 is high due to potential resource exhaustion vulnerabilities in the affected versions of FasterXML jackson-databind.

How do I fix REDHAT-BUG-2135244?

To fix REDHAT-BUG-2135244, upgrade FasterXML jackson-databind to version 2.14.0-rc1 or later, or update to versions 2.13.4.1 or 2.12.17.1.

Which versions of FasterXML jackson-databind are affected by REDHAT-BUG-2135244?

FasterXML jackson-databind versions prior to 2.14.0-rc1, as well as 2.13.4 and 2.12.17, are affected by REDHAT-BUG-2135244.

What feature is associated with the vulnerability in REDHAT-BUG-2135244?

The vulnerability in REDHAT-BUG-2135244 is associated with the UNWRAP_SINGLE_VALUE_ARRAYS feature, which can lead to deep wrapper array nesting.

How does REDHAT-BUG-2135244 impact application performance?

REDHAT-BUG-2135244 can lead to resource exhaustion, severely impacting application performance and potentially causing crashes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.