Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected products
- FasterXML / jackson-databind>= 2.18.0, < 2.18.9 – >= 2.18.0, < 2.18.9
- FasterXML / jackson-databind>= 2.21.0, < 2.21.5 – >= 2.21.0, < 2.21.5
- FasterXML / jackson-databind>= 2.22.0, < 2.22.1 – >= 2.22.0, < 2.22.1
- FasterXML / jackson-databind>= 3.0.0, < 3.1.5 – >= 3.0.0, < 3.1.5
- FasterXML / jackson-databind>= 3.2.0, < 3.2.1 – >= 3.2.0, < 3.2.1
References
- VENDOR_ADVISORYhttps://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh
- MISChttps://github.com/FasterXML/jackson-databind/issues/6060
- PATCHhttps://github.com/FasterXML/jackson-databind/pull/6056
- PATCHhttps://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b
Updated 5m ago · 8 sources