CGA-9cf5-xf8m-vq9m

Published

Last updated

https://images.chainguard.dev/security/CGA-9cf5-xf8m-vq9m

Package

hadoop-3.3

Latest Update

Under investigation

Aliases

Severity

5.9

Medium

CVSS V3

Summary

Deserialization of Untrusted Data in FasterXML jackson-databind

Description

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

References

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CGA-9cf5-xf8m-vq9m

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources