/aut

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2017-7525 -- com.fasterxml.jackson.core:jackson-databind #279

Closed
ruebot opened this Issue Oct 16, 2018 · 0 comments

Comments

Assignees

@ruebot ruebot

Labels
Projects
None yet
Milestone
No milestone
1 participant
@ruebot
@ruebot
Member

ruebot commented Oct 16, 2018

GitHub alert:

CVE-2017-7525 More information
high severity
Vulnerable versions: >= 2.8.0, < 2.8.9
Patched version: 2.8.9

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

https://nvd.nist.gov/vuln/detail/CVE-2017-7525

@ruebot ruebot added the security label Oct 16, 2018

@ruebot ruebot self-assigned this Oct 16, 2018

ruebot added a commit to ruebot/aut that referenced this issue Oct 16, 2018

@ruebot
Update jackson-databind version; resolves archivesunleashed#279. 
- CVE-2017-752
- See also: https://nvd.nist.gov/vuln/detail/CVE-2017-7525
Verified
This commit was signed with a verified signature.
@ruebot ruebot Nick Ruest
GPG key ID: 417FAF1A0E1080CD Learn about signing commits
a9b14a4

@ruebot ruebot referenced this issue Oct 16, 2018

Merged

Update jackson-databind version; resolves #279. #280

@ianmilligan1 ianmilligan1 closed this in 72cb5e2 Oct 16, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment