Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
[CVE-2022-42003] A Denial of Service (DoS) vulnerability in com.fasterxml.jackson.core:jackson-databind
See original GitHub issueDescribe the bug
Our security scanner on Keycloak reported a CVE coming from quarkus-jackson that might be worth to consider upgrading in the upcoming releases. Below, you can find more details.
Overview
com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. At the moment
Affected versions of this package are vulnerable to Denial of Service (DoS) in the _deserializeWrappedValue() function in StdDeserializer.java, due to resource exhaustion when processing deeply nested arrays.
NOTE: This vulnerability is only exploitable when the non-default UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
Remediation
Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.14.0-rc1 or higher.
References
Detailed paths
- Introduced through: org.keycloak:keycloak-quarkus-server-app@999-SNAPSHOT › org.keycloak:keycloak-quarkus-server@999-SNAPSHOT › io.quarkus:quarkus-reactive-routes@2.12.2.Final › io.quarkus:quarkus-jackson@2.12.2.Final › com.fasterxml.jackson.core:jackson-databind@2.13.3
Expected behavior
No response
Actual behavior
No response
How to Reproduce?
No response
Output of uname -a or ver
No response
Output of java -version
No response
GraalVM version (if different from Java)
No response
Quarkus version or git rev
No response
Build tool (ie. output of mvnw --version or gradlew --version)
No response
Additional information
No response
Issue Analytics
- State:
- Created a year ago
- Comments:11 (9 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
That is indeed true @famod - we don’t activate that and we don’t even expose a property for users to activate it - although of course users can configure their
ObjectMapperin any way they see fit.Sure, even if it is a public CVE, its visibility just gets increased.