https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Bug ID: 2064698 Summary: CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mrehak@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, alazarot@redhat.com, anstephe@redhat.com, asoldano@redhat.com, ataylor@redhat.com, bbaranow@redhat.com, bibryam@redhat.com, bmaxwell@redhat.com, bmontgom@redhat.com, boliveir@redhat.com, brian.stansberry@redhat.com, cdewolf@redhat.com, cdorney@redhat.com, cfu@redhat.com, chazlett@redhat.com, ckelley@redhat.com, darran.lofthouse@redhat.com, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, edewata@redhat.com, emingora@redhat.com, eparis@redhat.com, eric.wittmann@redhat.com, etirelli@redhat.com, fjuma@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, hbraun@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jmagne@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jrokos@redhat.com, jross@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, lgao@redhat.com, mharmsen@redhat.com, mnovotny@redhat.com, mosmerov@redhat.com, msochure@redhat.com, msvehla@redhat.com, nstielau@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pdelbell@redhat.com, pdrozd@redhat.com, pjindal@redhat.com, pmackay@redhat.com, puntogil@libero.it, rguimara@redhat.com, rhcs-maint@redhat.com, rrajasek@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, smaestri@redhat.com, sponnaga@redhat.com, sthorger@redhat.com, swoodman@redhat.com, tom.jenkinson@redhat.com, tzimanyi@redhat.com Target Milestone: --- Classification: Other
A Java StackOverflow exception and denial of service via a large depth of nested objects.
Reference:
https://github.com/FasterXML/jackson-databind/issues/2816
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Marian Rehak mrehak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2064699
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2064699 [Bug 2064699] CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #1 from Marian Rehak mrehak@redhat.com --- Created jackson-databind tracking bugs for this issue:
Affects: fedora-all [bug 2064699]
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Marian Rehak mrehak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2064700
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Avinash Hanwate ahanwate@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2064726
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|jackson-databind 2.13.0 |jackson-databind 2.12.6.1, | |jackson-databind 2.13.2.1
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #3 from Mauro Matteo Cascella mcascell@redhat.com --- Security advisory: https://github.com/advisories/GHSA-57j2-w4cx-62h2
Upstream commit: https://github.com/FasterXML/jackson-databind/commit/fcfc4998ec23f0b1f7f8a95...
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2070121, 2070122
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 8.3.1
Via RHSA-2022:2232 https://access.redhat.com/errata/RHSA-2022:2232
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:2232
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Doc Text *updated* by Patrick Del Bello pdelbell@redhat.com --- A flaw was found in Jackson Databind package caused by Java StackOverflow exception and denial of service via a large depth of nested objects.
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4922
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4918
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #13 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4919
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat AMQ 7.10.0
Via RHSA-2022:5101 https://access.redhat.com/errata/RHSA-2022:5101
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5101
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat build of Eclipse Vert.x 4.2.7
Via RHSA-2022:5029 https://access.redhat.com/errata/RHSA-2022:5029
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5029
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #16 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-36518
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |ERRATA Status|NEW |CLOSED Last Closed| |2022-06-23 14:39:33
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.11
Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat build of Quarkus 2.7.6
Via RHSA-2022:5596 https://access.redhat.com/errata/RHSA-2022:5596
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5596
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #20 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHAF Camel-K 1.8
Via RHSA-2022:6407 https://access.redhat.com/errata/RHSA-2022:6407
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6407
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.5 for RHEL 7
Via RHSA-2022:6782 https://access.redhat.com/errata/RHSA-2022:6782
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6782
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #22 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.5 for RHEL 8
Via RHSA-2022:6783 https://access.redhat.com/errata/RHSA-2022:6783
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6783
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #23 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On
Via RHSA-2022:6787 https://access.redhat.com/errata/RHSA-2022:6787
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6787
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHPAM 7.13.1 async
Via RHSA-2022:6813 https://access.redhat.com/errata/RHSA-2022:6813
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6813
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat AMQ Streams 2.2.0
Via RHSA-2022:6819 https://access.redhat.com/errata/RHSA-2022:6819
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6819
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #26 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 8
Via RHSA-2022:7410 https://access.redhat.com/errata/RHSA-2022:7410
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:7410
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 7
Via RHSA-2022:7409 https://access.redhat.com/errata/RHSA-2022:7409
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:7409
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 9
Via RHSA-2022:7411 https://access.redhat.com/errata/RHSA-2022:7411
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:7411
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6.1
Via RHSA-2022:7417 https://access.redhat.com/errata/RHSA-2022:7417
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:7417
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Logging subsystem for Red Hat OpenShift 5.4
Via RHSA-2022:7435 https://access.redhat.com/errata/RHSA-2022:7435
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:7435
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHOL-5.5-RHEL-8
Via RHSA-2022:8781 https://access.redhat.com/errata/RHSA-2022:8781
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:8781
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Logging 5.3
Via RHSA-2022:8889 https://access.redhat.com/errata/RHSA-2022:8889
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:8889
https://bugzilla.redhat.com/show_bug.cgi?id=2064698 Bug 2064698 depends on bug 2064699, which changed state.
Bug 2064699 Summary: CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2064699
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #34 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHOL-5.6-RHEL-8
Via RHSA-2023:0264 https://access.redhat.com/errata/RHSA-2023:0264
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:0264
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #35 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:2312 https://access.redhat.com/errata/RHSA-2023:2312
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:2312
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #36 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat AMQ Streams 2.4.0
Via RHSA-2023:3223 https://access.redhat.com/errata/RHSA-2023:3223
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:3223
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
--- Comment #38 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2024:3061 https://access.redhat.com/errata/RHSA-2024:3061
https://bugzilla.redhat.com/show_bug.cgi?id=2064698
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:3061
java-sig-commits@lists.fedoraproject.org