Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

Description

In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAPSINGLEVALUE_ARRAYS feature is enabled. This was patched in 2.12.7.1, 2.13.4.2, and 2.14.0.

Commits that introduced vulnerable code are

https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45, https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1, and https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc.

Fix commits are https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea and https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33.

The 2.13.4.1 release does fix this issue, however it also references a non-existent jackson-bom which causes build failures for gradle users. See https://github.com/FasterXML/jackson-databind/issues/3627#issuecomment-1277957548 for details. This is fixed in 2.13.4.2 which is listed in the advisory metadata so that users are not subjected to unnecessary build failures

Base CVSS

7.5

EPSS Score

0.28%

Introduced Version

2.4.0-rc1

Fix Available

2.12.7.1,2.13.4.1

Fix without Upgrading

Available Patches

Package

CVEs Fixed

Lines of Code Changed

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

com.fasterxml.jackson.core:jackson-databind

References

https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc

https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33

https://security.gentoo.org/glsa/202210-21

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020

https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea

https://security.netapp.com/advisory/ntap-20221124-0004

https://nvd.nist.gov/vuln/detail/CVE-2022-42003

https://github.com/FasterXML/jackson-databind/issues/3590

https://github.com/FasterXML/jackson-databind/commit/2c4a601c626f7790cad9d3c322d244e182838288

https://github.com/FasterXML/jackson-databind/blob/2.13/release-notes/VERSION-2.x

https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html

https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1

https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.13.4.1...jackson-databind-2.13.4.2

https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45

https://github.com/FasterXML/jackson-databind

https://github.com/FasterXML/jackson-databind/commits/jackson-databind-2.4.0-rc1?after=75b97b8519f0d50c62523ad85170d80a197a2c86+174&branch=jackson-databind-2.4.0-rc1&qualified_name=refs%2Ftags%2Fjackson-databind-2.4.0-rc1

https://github.com/FasterXML/jackson-databind/issues/3627

https://www.debian.org/security/2022/dsa-5283

AppSec for the Software Development Revolution

Endor Labs builds a complete graph of your software estate, so teams can pinpoint and fix critical risks in complex, dependency-rich code—whether it was written by humans or AI.

Welcome to the resistance

Oops! Something went wrong, please try again.