Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 534
Alerts This Week
Warning Icon 1 534

Red Hat Enterprise Linux 9 RHSA-2023:2312-01 Moderate: Jackson DoS Issue

red hat
Calendar Grey May 9, 2023
Dist Redhat Esm H88
The latest Jackson security patch for Red Hat Enterprise Linux 9 mitigates a moderate DoS vulnerability. Ensure the update is applied promptly.
An update for jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base is now available for Red Hat Enterprise Linux 9

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Jackson is a suite of data-processing tools for Java, including the flagship streaming JSON parser / generator library, matching data-binding library, and additional modules to process data encoded in various other data formats.
Security Fix(es):
* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory moderate DoS Red Hat Enterprise Linux jackson

References

https://access.redhat.com/security/cve/CVE-2020-36518 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: jackson-annotations-2.14.1-1.el9.src.rpm jackson-core-2.14.1-2.el9.src.rpm jackson-databind-2.14.1-2.el9.src.rpm jackson-jaxrs-providers-2.14.1-2.el9.src.rpm jackson-modules-base-2.14.1-2.el9.src.rpm
noarch: pki-jackson-annotations-2.14.1-1.el9.noarch.rpm pki-jackson-core-2.14.1-2.el9.noarch.rpm pki-jackson-databind-2.14.1-2.el9.noarch.rpm pki-jackson-jaxrs-json-provider-2.14.1-2.el9.noarch.rpm pki-jackson-jaxrs-providers-2.14.1-2.el9.noarch.rpm pki-jackson-module-jaxb-annotations-2.14.1-2.el9.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Advisory ID: RHSA-2023:2312-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2312
Issue date: 2023-05-09

Topic

An update for jackson-annotations, jackson-core, jackson-databind,jackson-jaxrs-providers, and jackson-modules-base is now available for RedHat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate DoS Red Hat Enterprise Linux jackson

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - noarch

Bugs Fixed

2064698 - CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.