CVE-2022-42004 Uncontrolled Resource Consumption in FasterXML jackson-databind
HighCVSS 7.5
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.4.0-rc1, < 2.12.7.1 | 2.12.7.1 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.0.pr1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.0.pr2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.0.pr3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.10.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.11.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.11.0.rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.11.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.11.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.11.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.11.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.5 | No fix listed |
Show 130 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.12.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.1.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.4.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.5.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.0-rc4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.6.7.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.0-rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.0-rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.0-rc3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.1-1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.7.9.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.0.rc1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.0.rc2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.10 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.11.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.8.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.8.9 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.0.pr4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.10.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.4 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.5 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.6 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.7 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.8 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.9 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.9.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.9.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.9.9.3 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | >= 2.13.0, < 2.13.4 | 2.13.4 |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.13.0 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.13.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.13.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.13.2.1 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.13.2.2 | No fix listed |
| com.fasterxml.jackson.core/jackson-databind(Maven) | = 2.13.3 | No fix listed |
| debian/jackson-databind(Debian:12) | < 2.14.0-1 | 2.14.0-1 |
| debian/jackson-databind(Debian:13) | < 2.14.0-1 | 2.14.0-1 |
| debian/jackson-databind(Debian:14) | < 2.14.0-1 | 2.14.0-1 |
| ubuntu/jackson-databind(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/jackson-databind(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/jackson-databind(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/jackson-databind(Ubuntu:26.10) | All versions | No fix listed |
| FasterXML jackson-databind | < 2.12.7.1 | 2.12.7.1 |
| FasterXML jackson-databind | >= 2.13.0, < 2.13.4 | 2.13.4 |
| quarkus | < 2.13.0 | 2.13.0 |
| debian linux | = 10.0 | No fix listed |
| debian linux | = 11.0 | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.chromium.org exploit issue-tracking mailing-list patch third-party-advisory
- github.com product
- [debian-lts-announce] 20221127 [SECURITY] [DLA 3207-1] jackson-databind security update mailing-list third-party-advisory
- GLSA-202210-21 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- DSA-5283 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2022-42004 vendor-advisory
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org