RHSA-2023:2312: Moderate: jackson security update
Jackson is a suite of data-processing tools for Java, including the flagship streaming JSON parser / generator library, matching data-binding library, and additional modules to process data encoded in various other data formats.Security Fix(es): jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:2312?
The severity of RHSA-2023:2312 is classified as critical due to its potential to cause denial of service.
How do I fix RHSA-2023:2312?
To fix RHSA-2023:2312, update the affected Jackson packages to the specified versions: jackson-annotations 2.14.1-1.el9, jackson-core 2.14.1-2.el9, jackson-databind 2.14.1-2.el9, and related packages.
Which packages are affected by RHSA-2023:2312?
The affected packages in RHSA-2023:2312 include jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and pki-jackson packages.
Is RHSA-2023:2312 related to Java applications?
Yes, RHSA-2023:2312 pertains to vulnerabilities in Jackson, which is primarily used for data processing in Java applications.
What type of vulnerability is addressed in RHSA-2023:2312?
RHSA-2023:2312 addresses a denial-of-service vulnerability in the Jackson data-processing tools.