Security Update for libjackson-json-java
Summary
DLA-2342-1: libjackson-json-java - security update. Affects libjackson-json-java versions < 1.9.2-8+deb9u1. Fixed in 1.9.2-8+deb9u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjackson-json-java is a Java JSON processor used for parsing and manipulating JSON data. It is widely used in various applications and frameworks for handling JSON objects. However, several vulnerabilities have been discovered in this library, which could potentially lead to security breaches and unauthorized access to sensitive information.
Vulnerability Detail
The vulnerabilities in libjackson-json-java include:
-
CVE-2017-7525: This vulnerability is related to a Jackson Deserializer issue, which could allow attackers to execute arbitrary code by exploiting the deserialization process.
-
CVE-2017-15095: This vulnerability involves polymorphic deserialization and affects certain JDK types. It could be exploited to bypass security measures and perform unauthorized actions.
-
CVE-2019-10172: This vulnerability is related to XML external entity (XXE) vulnerabilities, which could allow attackers to read arbitrary files or cause denial of service attacks by exploiting XML parsing functionality.
These vulnerabilities pose a significant risk to applications and systems that use libjackson-json-java, as they could be exploited to gain unauthorized access, execute arbitrary code, or cause denial of service.
How To Fix
Minimum fixed version
1.9.2-8+deb9u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjackson-json-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
libjackson-json-java is prone to multiple vulnerabilities that could lead to security breaches and unauthorized access. It is crucial to update the package to the latest version (1.9.2-8+deb9u1 or later) to mitigate these risks. Failure to address these vulnerabilities could result in potential exploitation and compromise of sensitive information. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libjackson-json-java →
FAQ
libjackson-json-java is a Java library used for processing and manipulating JSON data. It provides functionality for parsing, generating, and manipulating JSON objects and is widely used in various applications and frameworks.
These vulnerabilities could allow attackers to execute arbitrary code, bypass security measures, gain unauthorized access to sensitive information, or cause denial of service attacks. It is important to patch these vulnerabilities to prevent potential security breaches.
You can use tools like Vulert (https://vulert.com) to check if your application is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can also use the Vulert playground (https://vulert.com/scanner) without signing up to check if your application is affected.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the libjackson-json-java package to the latest version to mitigate the risks.
You can find more information about these vulnerabilities in the Debian LTS security advisories. Refer to the security tracker page for libjackson-json-java at https://security-tracker.debian.org/tracker/libjackson-json-java for detailed security status and updates.
Related vulnerabilities
Recent vulnerabilities recorded for libjackson-json-java.
