Orta CVSS 5.9

CVE-2019-12384: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: 24 Haziran 2019 19:15 · Güncelleme: 6 Kasım 2026 09:45

Açıklama (NVD)

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %45,21 (yüzdelik 99)
CWE: CWE-502
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.0.0	—	2.6.7.3
fasterxml-jackson-databind	2.7.0	—	2.7.9.6
fasterxml-jackson-databind	2.8.0	—	2.8.11.4
fasterxml-jackson-databind	2.9.0	—	2.9.9.1
debian-debian-linux	8.0	8.0	—
redhat-enterprise-linux	7.0	7.0	—
redhat-enterprise-linux	7.4	7.4	—
redhat-enterprise-linux	7.5	7.5	—
redhat-enterprise-linux	7.6	7.6	—
redhat-enterprise-linux	7.7	7.7	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları