Security Update for libjackson-json-java
Summary
DLA-2091-1: libjackson-json-java - security update. Affects libjackson-json-java versions < 1.9.2-3+deb8u1. Fixed in 1.9.2-3+deb8u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjackson-json-java is a Java library for processing JSON data. It provides functionality for parsing, generating, and manipulating JSON objects. This library is widely used in Java applications for handling JSON data. However, several vulnerabilities have been discovered in libjackson-json-java, which could potentially be exploited by attackers to execute arbitrary code or perform XML external entity attacks.
Vulnerability Detail
The vulnerabilities in libjackson-json-java include:
-
CVE-2017-7525: This vulnerability is related to a security issue in the Jackson Deserializer, which could allow attackers to execute arbitrary code by exploiting the deserialization process.
-
CVE-2017-15095: This vulnerability blocks certain JDK types from polymorphic deserialization, preventing potential attacks that could abuse polymorphic deserialization.
-
CVE-2019-10172: This vulnerability involves XML external entity vulnerabilities, which could allow attackers to read arbitrary files or conduct denial-of-service attacks by exploiting XML parsing functionality.
These vulnerabilities pose a significant risk to applications that use libjackson-json-java, as they could lead to remote code execution, data leakage, or service disruption.
How To Fix
Minimum fixed version
1.9.2-3+deb8u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjackson-json-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. However, it is crucial to update the libjackson-json-java package to the fixed version as soon as possible to mitigate the risks associated with these vulnerabilities.
Conclusion
libjackson-json-java is prone to multiple vulnerabilities that could lead to remote code execution, data leakage, or service disruption. It is crucial to update the libjackson-json-java package to the fixed version (1.9.2-3+deb8u1 or later) to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libjackson-json-java →
FAQ
libjackson-json-java is a Java library used for processing JSON data. It provides functionality for parsing, generating, and manipulating JSON objects.
These vulnerabilities could allow attackers to execute arbitrary code, abuse polymorphic deserialization, or conduct XML external entity attacks, leading to remote code execution, data leakage, or service disruption.
To fix these vulnerabilities, it is recommended to upgrade the libjackson-json-java package to version 1.9.2-3+deb8u1 or later. Detailed instructions can be found in the Debian LTS security advisories and documentation.
There are no specific workarounds mentioned for these vulnerabilities. However, updating the libjackson-json-java package to the fixed version is crucial to mitigate the risks.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for libjackson-json-java.
