DirectorySecurity Advisories
Sign In
Security Advisories

CGA-hqhv-3pr5-xmfj

Published

Last updated

https://images.chainguard.dev/security/CGA-hqhv-3pr5-xmfj
Package

hive

Latest Update
Fixed
Fixed Version

4.0.1-r1

Aliases
  • CVE-2020-14062
  • GHSA-c265-37vj-cwcc

Severity

8.1

High

CVSS V3

Summary

Deserialization of untrusted data in Jackson Databind

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images