In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jackson-databind | Fasterxml | * | 2.12.7.1 (excluding) |
| Jackson-databind | Fasterxml | 2.13.0 (including) | 2.13.4 (excluding) |
| Important: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update | RedHat | jackson-databind | * |
| Logging subsystem for Red Hat OpenShift 5.4 | RedHat | openshift-logging/elasticsearch6-rhel8:v6.8.1-265 | * |
| Logging subsystem for Red Hat OpenShift 5.4 | RedHat | openshift-logging/elasticsearch-operator-bundle:v5.4.8-11 | * |
| Logging subsystem for Red Hat OpenShift 5.4 | RedHat | openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-300 | * |
| Logging subsystem for Red Hat OpenShift 5.4 | RedHat | openshift-logging/elasticsearch-rhel8-operator:v5.4.8-3 | * |
| Migration Toolkit for Runtimes 1 on RHEL 8 | RedHat | jackson-databind | * |
| OCP-Tools-4.12-RHEL-8 | RedHat | jenkins-2-plugins-0:4.12.1675702407-1.el8 | * |
| OpenShift Developer Tools and Services for OCP 4.11 | RedHat | jenkins-2-plugins-0:4.11.1686831822-1.el8 | * |
| OpenShift Logging 5.3 | RedHat | openshift-logging/elasticsearch6-rhel8:v6.8.1-277 | * |
| OpenShift Logging 5.3 | RedHat | openshift-logging/elasticsearch-operator-bundle:v5.3.14-16 | * |
| OpenShift Logging 5.3 | RedHat | openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-315 | * |
| OpenShift Logging 5.3 | RedHat | openshift-logging/elasticsearch-rhel8-operator:v5.3.14-5 | * |
| Red Hat AMQ Broker 7 | RedHat | jackson-databind | * |
| Red Hat AMQ Streams 2.3.0 | RedHat | jackson-databind | * |
| Red Hat AMQ Streams 2.4.0 | RedHat | * | |
| Red Hat build of Eclipse Vert.x 4.3.4 | RedHat | jackson-databind | * |
| Red Hat build of Quarkus 2.13.5 | RedHat | jackson-databind | * |
| Red Hat build of Quarkus 2.7.7 | RedHat | * | |
| Red Hat Data Grid 8.4.1 | RedHat | jackson-databind | * |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | RedHat | eap7-jackson-databind-0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | RedHat | eap7-resteasy-0:3.0.27-1.Final_redhat_00001.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-jackson-databind-0:2.10.4-4.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-jackson-modules-java8-0:2.10.4-2.redhat_00004.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | RedHat | eap7-resteasy-0:3.11.6-1.Final_redhat_00001.1.el7eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | RedHat | eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | RedHat | eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | RedHat | eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap | * |
| Red Hat Satellite 6.13 for RHEL 8 | RedHat | candlepin-0:4.2.13-1.el8sat | * |
| Red Hat Single Sign-On 7 | RedHat | jackson-databind | * |
| Red Hat Single Sign-On 7.6 for RHEL 7 | RedHat | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 8 | RedHat | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 9 | RedHat | rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso | * |
| RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso76-openshift-rhel8:7.6-20 | * |
| RHINT Camel-Q 2.13.2 | RedHat | jackson-databind | * |
| RHINT Camel-Springboot 3.18.3.P2 | RedHat | jackson-databind | * |
| RHINT Camel-Springboot 3.20.1 | RedHat | jackson-databind | * |
| RHOL-5.5-RHEL-8 | RedHat | openshift-logging/elasticsearch6-rhel8:v6.8.1-273 | * |
| RHOL-5.5-RHEL-8 | RedHat | openshift-logging/elasticsearch-operator-bundle:v5.5.5-14 | * |
| RHOL-5.5-RHEL-8 | RedHat | openshift-logging/elasticsearch-proxy-rhel8:v1.0.0-311 | * |
| RHOL-5.5-RHEL-8 | RedHat | openshift-logging/elasticsearch-rhel8-operator:v5.5.5-2 | * |
| RHOL-5.6-RHEL-8 | RedHat | openshift-logging/elasticsearch6-rhel8:v6.8.1-285 | * |
| RHPAM 7.13.1 async | RedHat | jackson-databind | * |
| Jackson-databind | Ubuntu | esm-apps/jammy | * |
| Jackson-databind | Ubuntu | jammy | * |
| Jackson-databind | Ubuntu | kinetic | * |
| Jackson-databind | Ubuntu | lunar | * |
| Jackson-databind | Ubuntu | mantic | * |
| Jackson-databind | Ubuntu | oracular | * |
| Jackson-databind | Ubuntu | trusty | * |
| Jackson-databind | Ubuntu | xenial | * |