CVE-2023-35116
First published: Wed Jun 14 2023(Updated: )
** DISPUTED ** jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FasterXML jackson-databind | <=2.15.2 | |
| redhat/jackson-databind | <2.15.2 | 2.15.2 |
| FasterXML jackson-databind | <2.16.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/FasterXML/jackson-databind/issues/3972
- https://exchange.xforce.ibmcloud.com/vulnerabilities/258157
- https://www.ibm.com/support/pages/node/7049133 (Advisory)
- https://access.redhat.com/errata/RHSA-2023:5396
- https://access.redhat.com/errata/RHSA-2024:0719
- https://access.redhat.com/errata/RHSA-2024:0777
- https://access.redhat.com/errata/RHSA-2024:1027
- https://access.redhat.com/errata/RHSA-2024:2707
- https://access.redhat.com/errata/RHSA-2024:6893
- https://bugzilla.redhat.com/show_bug.cgi?id=2215214
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-35116.
What is the severity of CVE-2023-35116?
The severity of CVE-2023-35116 is medium with a severity value of 4.7.
Which software is affected by this vulnerability?
The FasterXML jackson-databind software up to version 2.15.2 is affected by this vulnerability.
What is the impact of this vulnerability?
This vulnerability allows attackers to cause a denial of service or other unspecified impact by using crafted objects with cyclic dependencies.
Is there a fix available for CVE-2023-35116?
At the moment, there is no information available about a fix for this vulnerability.
- collector/nvd-index
- agent/author
- agent/type
- agent/severity
- agent/weakness
- agent/status
- agent/softwarecombine
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-35116
- status/disputed
- vendor/fasterxml
- canonical/fasterxml jackson-databind
- version/fasterxml jackson-databind/2.15.2
- vendor/ibm
- canonical/ibm qradar siem
- version/ibm qradar siem/7.5.0 - 7.5.0 up6
- package-manager/redhat