CVE-2020-36518

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.

Security Fix(es):

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.(CVE-2020-36518)

In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1(CVE-2022-42003)

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.(CVE-2022-42004)

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.

Security Fix(es):

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.(CVE-2020-36518)

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.(CVE-2022-42003)

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.(CVE-2022-42004)

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.11.3.rhlw-00004 with backported fixes for CVE-2020-36518, CVE-2022-42004, and CVE-2021-46877.

CVE-2020-36518: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVE-2022-42004: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

CVE-2021-46877: jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.11.3 from Maven Central.

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Jackson is a suite of data-processing tools for Java, including the flagship streaming JSON parser / generator library, matching data-binding library, and additional modules to process data encoded in various other data formats.

Security Fix(es):

• jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.

Security Fix(es):

• jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2020-36518: fix denial of service via a large depth of nested objects

• Removed CVE-2020-36518.patch: jackson-databind 2.14.1-1 is not affected
• Rebuilt with the CVE-2025-52999: fixed jackson-core version

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.12.1-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.2-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.6-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.5-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.12.4-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.13.0-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.13.1-tuxcare.1.

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. (CVE-2020-36518) In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. (CVE-2022-42003) In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. (CVE-2022-42004)

These are all security issues fixed in the jackson-databind-2.13.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jackson-annotations-2.13.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jackson-core-2.13.0-3.1 package on the GA media of openSUSE Tumbleweed.

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

• jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Root has patched CVE-2020-36518 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.

This update for jackson-databind, jackson-dataformats-binary, jackson-annotations, jackson-bom, jackson-core fixes the following issues:

Security issues fixed:

• CVE-2020-36518: Fixed a Java stack overflow exception and denial of service via a large depth of nested objects in jackson-databind. (bsc#1197132)
• CVE-2020-25649: Fixed an insecure entity expansion in jackson-databind which was vulnerable to XML external entity (XXE). (bsc#1177616)
• CVE-2020-28491: Fixed a bug which could cause java.lang.OutOfMemoryError exception in jackson-dataformats-binary. (bsc#1182481)

Non security fixes:

jackson-annotations - update from version 2.10.2 to version 2.13.0:

• Build with source/target levels 8
• Add 'mvnw' wrapper
• 'JsonSubType.Type' should accept array of names
• Jackson version alignment with Gradle 6
• Add '@JsonIncludeProperties'
• Add '@JsonTypeInfo(use=DEDUCTION)'
• Ability to use '@JsonAnyGetter' on fields
• Add '@JsonKey' annotation
• Allow repeated calls to 'SimpleObjectIdResolver.bindItem()' for same mapping
• Add 'namespace' property for '@JsonProperty' (for XML module)
• Add target 'ElementType.ANNOTATION_TYPE' for '@JsonEnumDefaultValue'
• 'JsonPattern.Value.pattern' retained as '', never (accidentally) exposed as 'null'
• Rewrite to use ant for building in order to be able to use it in packages that have to be built before maven

jackson-bom - update from version 2.10.2 to version 2.13.0:

• Configure moditect plugin with '<jvmVersion>11</jvmVersion>'
• jackson-bom manages the version of 'junit:junit'
• Drop 'jackson-datatype-hibernate3' (support for Hibernate 3.x datatypes)
• Removed 'jakarta' classifier variants of JAXB/JSON-P/JAX-RS modules due to the addition of new Jakarta artifacts (Jakarta-JSONP, Jakarta-xmlbind-annotations, Jakarta-rs-providers)
• Add version for 'jackson-datatype-jakarta-jsonp' module (introduced after 2.12.2)
• Add (beta) version for 'jackson-dataformat-toml'
• Jakarta 9 artifact versions are missing from jackson-bom
• Add default settings for 'gradle-module-metadata-maven-plugin' (gradle metadata)
• Add default settings for 'build-helper-maven-plugin'
• Drop 'jackson-module-scala_2.10' entry (not released for Jackson 2.12 or later)
• Add override for 'version.plugin.bundle' (for 5.1.1) to help build on JDK 15+
• Add missing version for jackson-datatype-eclipse-collections

jackson-core - update from version 2.10.2 to version 2.13.0:

• Build with source and target levels 8
• Misleading exception for input source when processing byte buffer with start offset
• Escape contents of source document snippet for 'JsonLocation._appendSourceDesc()'
• Add 'StreamWriteException' type to eventually replace 'JsonGenerationException'
• Replace 'getCurrentLocation()'/'getTokenLocation()' with 'currentLocation()'/'currentTokenLocation()' in 'JsonParser'
• Replace 'JsonGenerator.writeObject()' (and related) with 'writePOJO()'
• Replace 'getCurrentValue()'/'setCurrentValue()' with 'currentValue()'/'assignCurrentValue()' in 'JsonParser'/'JsonGenerator
• Introduce O(n^1.5) BigDecimal parser implementation
• ByteQuadsCanonicalizer.addName(String, int, int) has incorrect handling for case of q2 == null
• UTF32Reader ArrayIndexOutOfBoundsException
• Improve exception/JsonLocation handling for binary content: don't show content, include byte offset
• Fix an issue with the TokenFilter unable to ignore properties when deserializing.
• Optimize array allocation by 'JsonStringEncoder'
• Add 'mvnw' wrapper
• (partial) Optimize array allocation by 'JsonStringEncoder'
• Add back accidentally removed 'JsonStringEncoder' related methods in 'BufferRecyclers' (like 'getJsonStringEncoder()')
• 'ArrayOutOfBoundException' at 'WriterBasedJsonGenerator.writeString(Reader, int)'
• Allow 'optional-padding' for 'Base64Variant'
• More customizable TokenFilter…