CVE-2022-42004
02.10.2022, 05:15
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.Enginsight
| Vendor | Product | Version |
|---|---|---|
| fasterxml | jackson-databind | 𝑥 < 2.12.7.1 |
| fasterxml | jackson-databind | 2.13.0 ≤ 𝑥 < 2.13.4 |
| quarkus | quarkus | 𝑥 < 2.13.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| netapp | oncommand_workflow_automation | - |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References