[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-502 |S:U/C:H/I:H/A:H,cwe=CWE-502
|,eap-6/resteasy=affected,fe |,eap-6/resteasy=affected,fe
|dora-all/jackson-databind=a |dora-all/jackson-databind=a
|ffected,jdg-7/jackson-datab |ffected,jdg-7/jackson-datab
|ind=notaffected,jon-3/reste |ind=notaffected,jon-3/reste
|asy=affected,openshift-ente |asy=affected,openshift-ente
|rprise-2/jackson-databind=a |rprise-2/jackson-databind=a
|ffected,dts-4/devtoolset-4- |ffected,dts-4/devtoolset-4-
|jackson-databind=wontfix,rh |jackson-databind=wontfix,rh
|ev-m-3/jasperreports-server |ev-m-3/jasperreports-server
|-pro=wontfix,rhev-m-4/eap7- |-pro=wontfix,rhev-m-4/eap7-
|jackson-databind=affected,a |jackson-databind=affected,a
|mq-6/jackson-databind=notaf |mq-6/jackson-databind=notaf
|fected,bpms-6/jackson-datab |fected,bpms-6/jackson-datab
|ind=affected,jdv-6/jackson- |ind=affected,jdv-6/jackson-
|databind=notaffected,fuse-6 |databind=notaffected,fuse-6
|/jackson-databind=notaffect |/jackson-databind=notaffect
|ed,rhmap-4/jackson-databind |ed,rhmap-4/jackson-databind
|=notaffected,rhn_satellite_ |=notaffected,rhn_satellite_
|6/jackson-databind=new,rhsc |6/jackson-databind=new,rhsc
|l-3/rh-eclipse46-jackson-da |l-3/rh-eclipse46-jackson-da
|tabind=affected,rhscl-3/rh- |tabind=affected,rhscl-3/rh-
|maven35-jackson-databind=af |maven35-jackson-databind=af
|fected,sam-1/jackson-databi |fected,sam-1/jackson-databi
|nd=wontfix,eap-7/resteasy=a |nd=wontfix,eap-7/resteasy=a
|ffected,brms-6/jackson-data |ffected,brms-6/jackson-data
|bind=affected,swarm-7/jacks |bind=affected,swarm-7/jacks
|on-databind=affected,vertx- |on-databind=affected,vertx-
|3/jackson-databind=notaffec |3/jackson-databind=notaffec
|ted,openshift-enterprise-4. |ted,openshift-enterprise-4.
|1/logging-elasticsearch5-co |1/logging-elasticsearch5-co
|ntainer=affected,openshift- |ntainer=affected,openshift-
|enterprise-3.11/logging-ela |enterprise-3.11/logging-ela
|sticsearch5-container=affec |sticsearch5-container=affec
|ted |ted,openshift-enterprise-3.
| |10/openshift-elasticsearch-
| |plugin=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 8 months
[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1506612
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71102,reported=20171014,sou |71102,reported=20171014,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-184 |S:U/C:H/I:H/A:H,cwe=CWE-184
|,fedora-all/jackson-databin |,fedora-all/jackson-databin
|d=affected,amq-6/jackson-da |d=affected,amq-6/jackson-da
|tabind=notaffected,jdg-7/ja |tabind=notaffected,jdg-7/ja
|ckson-databind=notaffected, |ckson-databind=notaffected,
|jdv-6/jackson-databind=affe |jdv-6/jackson-databind=affe
|cted,eap-7/jackson-databind |cted,eap-7/jackson-databind
|=affected,bpms-6/jackson-da |=affected,bpms-6/jackson-da
|tabind=affected,brms-6/jack |tabind=affected,brms-6/jack
|son-databind=affected,fuse- |son-databind=affected,fuse-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,openshift-enterprise-2/ |ted,openshift-enterprise-2/
|jackson-databind=notaffecte |jackson-databind=notaffecte
|d,rhn_satellite_6/jackson-d |d,rhn_satellite_6/jackson-d
|atabind=affected/impact=low |atabind=affected/impact=low
|,rhmap-4/jackson-databind=n |,rhmap-4/jackson-databind=n
|otaffected,sam-1/jackson-da |otaffected,sam-1/jackson-da
|tabind=wontfix,rhev-m-3/jas |tabind=wontfix,rhev-m-3/jas
|perreports-server-pro=wontf |perreports-server-pro=wontf
|ix/impact=moderate,rhev-m-4 |ix/impact=moderate,rhev-m-4
|/eap7-jackson-databind=affe |/eap7-jackson-databind=affe
|cted/impact=moderate,rhscl- |cted/impact=moderate,rhscl-
|3/rh-eclipse46-jackson-data |3/rh-eclipse46-jackson-data
|bind=affected,jon-3/Core |bind=affected,jon-3/Core
|Server=notaffected,eap-6/ja |Server=notaffected,eap-6/ja
|ckson-databind=affected,dts |ckson-databind=affected,dts
|-4/devtoolset-4-jackson-dat |-4/devtoolset-4-jackson-dat
|abind=wontfix,rhscl-3/rh-ma |abind=wontfix,rhscl-3/rh-ma
|ven35-jackson-databind=affe |ven35-jackson-databind=affe
|cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin
|d=affected,openshift-enterp |d=affected,openshift-enterp
|rise-4.1/logging-elasticsea |rise-4.1/logging-elasticsea
|rch5-container=affected,ope |rch5-container=affected,ope
|nshift-enterprise-3.11/logg |nshift-enterprise-3.11/logg
|ing-elasticsearch5-containe |ing-elasticsearch5-containe
|r=affected |r=affected,openshift-enterp
| |rise-3.10/openshift-elastic
| |search-plugin=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 8 months
[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1462702
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70714,reported=20170616,sou |70714,reported=20170616,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-20, |S:U/C:H/I:H/A:H,cwe=CWE-20,
|amq-6/jackson-databind=affe |amq-6/jackson-databind=affe
|cted,jdg-7/jackson-databind |cted,jdg-7/jackson-databind
|=affected,jdv-6/jackson-dat |=affected,jdv-6/jackson-dat
|abind=affected,eap-7/jackso |abind=affected,eap-7/jackso
|n-databind=affected,bpms-6/ |n-databind=affected,bpms-6/
|jackson-databind=affected,b |jackson-databind=affected,b
|rms-6/jackson-databind=affe |rms-6/jackson-databind=affe
|cted,fuse-6/jackson-databin |cted,fuse-6/jackson-databin
|d=wontfix,openshift-enterpr |d=wontfix,openshift-enterpr
|ise-2/jackson-databind=wont |ise-2/jackson-databind=wont
|fix,rhn_satellite_6/jackson |fix,rhn_satellite_6/jackson
|-databind=affected/impact=l |-databind=affected/impact=l
|ow,rhmap-4/jackson-databind |ow,rhmap-4/jackson-databind
|=notaffected,sam-1/jackson- |=notaffected,sam-1/jackson-
|databind=wontfix,rhev-m-3/j |databind=wontfix,rhev-m-3/j
|asperreports-server-pro=won |asperreports-server-pro=won
|tfix,rhev-m-4/eap7-jackson- |tfix,rhev-m-4/eap7-jackson-
|databind=affected,rhscl-2/r |databind=affected,rhscl-2/r
|h-eclipse46-jackson-databin |h-eclipse46-jackson-databin
|d=affected,fedora-all/jacks |d=affected,fedora-all/jacks
|on-databind=affected,jon-3/ |on-databind=affected,jon-3/
|Core |Core
|Server=notaffected,eap-6/ja |Server=notaffected,eap-6/ja
|ckson-databind=affected,dts |ckson-databind=affected,dts
|-4/devtoolset-4-jackson-dat |-4/devtoolset-4-jackson-dat
|abind=affected,rhscl-3/rh-m |abind=affected,rhscl-3/rh-m
|aven35-jackson-databind=aff |aven35-jackson-databind=aff
|ected,vertx-3/jackson-datab |ected,vertx-3/jackson-datab
|ind=notaffected,swarm-7/jac |ind=notaffected,swarm-7/jac
|kson-databind=notaffected,o |kson-databind=notaffected,o
|penshift-enterprise-4.1/log |penshift-enterprise-4.1/log
|ging-elasticsearch5-contain |ging-elasticsearch5-contain
|er=affected,openshift-enter |er=affected,openshift-enter
|prise-3.11/logging-elastics |prise-3.11/logging-elastics
|earch5-container=affected |earch5-container=affected,o
| |penshift-enterprise-3.10/op
| |enshift-elasticsearch-plugi
| |n=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 8 months
[Bug 1549276] CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1549276
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0226,reported=20180226,sour |0226,reported=20180226,sour
|ce=cve,cvss3=8.1/CVSS:3.0/A |ce=cve,cvss3=8.1/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:H/ |V:N/AC:H/PR:N/UI:N/S:U/C:H/
|I:H/A:H,cwe=CWE-20,amq-6/ja |I:H/A:H,cwe=CWE-20,amq-6/ja
|ckson-databind=wontfix,jdg- |ckson-databind=wontfix,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jdv-6/jackson-databind= |ted,jdv-6/jackson-databind=
|wontfix,eap-7/jackson-datab |wontfix,eap-7/jackson-datab
|ind=affected,bpms-6/jackson |ind=affected,bpms-6/jackson
|-databind=affected,brms-6/j |-databind=affected,brms-6/j
|ackson-databind=affected,fu |ackson-databind=affected,fu
|se-6/jackson-databind=wontf |se-6/jackson-databind=wontf
|ix,openshift-enterprise-2/j |ix,openshift-enterprise-2/j
|ackson-databind=new,rhn_sat |ackson-databind=new,rhn_sat
|ellite_6/jackson-databind=n |ellite_6/jackson-databind=n
|otaffected/impact=low,rhmap |otaffected/impact=low,rhmap
|-4/jackson-databind=notaffe |-4/jackson-databind=notaffe
|cted,sam-1/jackson-databind |cted,sam-1/jackson-databind
|=wontfix,rhev-m-4/eap7-jack |=wontfix,rhev-m-4/eap7-jack
|son-databind=affected,rhscl |son-databind=affected,rhscl
|-3/rh-eclipse46-jackson-dat |-3/rh-eclipse46-jackson-dat
|abind=wontfix,fedora-all/ja |abind=wontfix,fedora-all/ja
|ckson-databind=affected,jon |ckson-databind=affected,jon
|-3/Core |-3/Core
|Server=new,eap-6/jackson-da |Server=new,eap-6/jackson-da
|tabind=affected,rhscl-3/rh- |tabind=affected,rhscl-3/rh-
|maven35-jackson-databind=af |maven35-jackson-databind=af
|fected,vertx-3/jackson-data |fected,vertx-3/jackson-data
|bind=affected,swarm-7/jacks |bind=affected,swarm-7/jacks
|on-databind=affected,fis-2/ |on-databind=affected,fis-2/
|jackson-databind=affected,f |jackson-databind=affected,f
|use-7/Camel=affected,opensh |use-7/Camel=affected,opensh
|ift-enterprise-4.1/logging- |ift-enterprise-4.1/logging-
|elasticsearch5-container=af |elasticsearch5-container=af
|fected,openshift-enterprise |fected,openshift-enterprise
|-3.11/logging-elasticsearch |-3.11/logging-elasticsearch
|5-container=affected |5-container=affected,opensh
| |ift-enterprise-3.10/openshi
| |ft-elasticsearch-plugin=aff
| |ected
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 8 months
[Bug 1538332] CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1538332
Sam Fowler <sfowler(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0118,reported=20180122,sour |0118,reported=20180122,sour
|ce=cve,cvss3=8.1/CVSS:3.0/A |ce=cve,cvss3=8.1/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:H/ |V:N/AC:H/PR:N/UI:N/S:U/C:H/
|I:H/A:H,cwe=CWE-502,jdv-6/j |I:H/A:H,cwe=CWE-502,jdv-6/j
|ackson-databind=wontfix,jbd |ackson-databind=wontfix,jbd
|s-10/jackson-databind=wontf |s-10/jackson-databind=wontf
|ix,amq-6/jackson-databind=n |ix,amq-6/jackson-databind=n
|otaffected,bpms-6/jackson-d |otaffected,bpms-6/jackson-d
|atabind=affected,jdg-7/jack |atabind=affected,jdg-7/jack
|son-databind=notaffected,jb |son-databind=notaffected,jb
|ds-8/jackson-databind=wontf |ds-8/jackson-databind=wontf
|ix,eap-7/jackson-databind=a |ix,eap-7/jackson-databind=a
|ffected/impact=moderate/cvs |ffected/impact=moderate/cvs
|s3=8.1/CVSS:3.0/AV:N/AC:H/P |s3=8.1/CVSS:3.0/AV:N/AC:H/P
|R:N/UI:N/S:U/C:H/I:H/A:H,fu |R:N/UI:N/S:U/C:H/I:H/A:H,fu
|se-6/jackson-databind=notaf |se-6/jackson-databind=notaf
|fected,rhsso-7/jackson-data |fected,rhsso-7/jackson-data
|bind=notaffected,sam-1/jack |bind=notaffected,sam-1/jack
|son-databind=wontfix,rhscl- |son-databind=wontfix,rhscl-
|3/rh-eclipse46-jackson-data |3/rh-eclipse46-jackson-data
|bind=wontfix,rhev-m-4/jacks |bind=wontfix,rhev-m-4/jacks
|on-databind=affected,fedora |on-databind=affected,fedora
|-all/jackson-databind=affec |-all/jackson-databind=affec
|ted,openshift-1/jackson-dat |ted,openshift-1/jackson-dat
|abind=affected,rhscl-3/rh-m |abind=affected,rhscl-3/rh-m
|aven35-jackson-databind=aff |aven35-jackson-databind=aff
|ected,rhn_satellite_6/jacks |ected,rhn_satellite_6/jacks
|on-databind=wontfix,eap-6/j |on-databind=wontfix,eap-6/j
|ackson-databind=affected/im |ackson-databind=affected/im
|pact=moderate/cvss3=8.1/CVS |pact=moderate/cvss3=8.1/CVS
|S:3.0/AV:N/AC:H/PR:N/UI:N/S |S:3.0/AV:N/AC:H/PR:N/UI:N/S
|:U/C:H/I:H/A:H,openshift-en |:U/C:H/I:H/A:H,openshift-en
|terprise-4.1/logging-elasti |terprise-4.1/logging-elasti
|csearch5-container=affected |csearch5-container=affected
|,openshift-enterprise-3.11/ |,openshift-enterprise-3.11/
|logging-elasticsearch5-cont |logging-elasticsearch5-cont
|ainer=affected |ainer=affected,openshift-en
| |terprise-3.10/openshift-ela
| |sticsearch-plugin=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 8 months