REDHAT-BUG-2491999: High severity fasterxml jackson-databind vulnerability
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2491999?
The severity of REDHAT-BUG-2491999 is rated as high with a score of 7.
What is the risk associated with REDHAT-BUG-2491999?
The risk associated with REDHAT-BUG-2491999 is classified as 33.
How do I fix REDHAT-BUG-2491999?
To fix REDHAT-BUG-2491999, update your version of fasterxml jackson-databind to the latest available version.
What type of vulnerability is REDHAT-BUG-2491999?
REDHAT-BUG-2491999 is classified as a potential Denial-of-Service vulnerability.
Which versions of jackson-databind are affected by REDHAT-BUG-2491999?
Versions of jackson-databind from 2.13.0 to 2.14.0 are affected by REDHAT-BUG-2491999.