All errata/sisyphus/ALT-PU-2021-1907-2
ALT-PU-2021-1907-2

Package update jackson-databind in branch sisyphus

Version2.11.2-alt1_2jpp11
Task#273354
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (3)

BDU:2022-05602
HIGH7.5

Уязвимость компонента DOMDeserializer библиотеки FasterXML jackson-databind, позволяющая нарушителю проводить XXE-атаки

Published: 2022-09-08Modified: 2025-06-18
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N
References
CVE-2020-25649
HIGH7.5

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Published: 2020-12-03Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
GHSA-288c-cq4h-88gq
HIGH7.5

XML External Entity (XXE) Injection in Jackson Databind

Published: 2021-02-18Modified: 2024-03-15
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References