NetSight
IP …
high7.5

CVE-2020-36518

Deeply nested json in jackson-databind

Impact

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.13.0, <= 2.13.2.02.13.2.1

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
before 2.12.6.1
from 2.13.0 before 2.13.2.1
OracleBig Data Spatial And Graph
before 23.1
OracleCoherence
Version 14.1.1.0.0
OracleCommerce Platform
Versions 11.3.0, 11.3.1, 11.3.2
OracleCommunications Billing And Revenue Management
from 12.0.0.4.0 through 12.0.0.6.0
OracleCommunications Cloud Native Core Binding Support Function
Version 22.1.3
OracleCommunications Cloud Native Core Console
Version 1.9.0
OracleCommunications Cloud Native Core Network Repository Function
Versions 22.1.2, 22.2.0
OracleCommunications Cloud Native Core Network Slice Selection Function
Versions 22.1.0, 22.1.1
OracleCommunications Cloud Native Core Security Edge Protection Proxy
Version 22.1.1
OracleCommunications Cloud Native Core Service Communication Proxy
Version 22.2.0
OracleCommunications Cloud Native Core Unified Data Repository
Version 22.2.0

Weakness classification

CWE-787

References