Debian Security Advisory
DLA-2153-1 jackson-databind -- LTS security update
- Date Reported:
- 22 Mar 2020
- Affected Packages:
- jackson-databind
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2020-10672, CVE-2020-10673.
- More information:
-
The following CVE(s) were reported against jackson-databind.
- CVE-2020-10672
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
- CVE-2020-10673
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
For Debian 8
Jessie
, these problems have been fixed in version 2.4.2-2+deb8u13.We recommend that you upgrade your jackson-databind packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
- CVE-2020-10672