jackson-databind-2.13.3.jar: 2 vulnerabilities (highest severity is: 8.7) reachable

[ws-on-ws]

Vulnerable Library - jackson-databind-2.13.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.13.3/jackson-databind-2.13.3.jar

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jackson-databind version)	Remediation Possible**	Reachability
CVE-2022-42003	High	8.7	jackson-databind-2.13.3.jar	Direct	2.13.4.1	✅	Reachable
CVE-2022-42004	High	8.2	jackson-databind-2.13.3.jar	Direct	2.13.4	✅	Reachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-42003

Vulnerable Library - jackson-databind-2.13.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.13.3/jackson-databind-2.13.3.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.13.3.jar (Vulnerable Library)

Found in base branches: integration, master

Reachability Analysis

This vulnerability is potentially reachable

org.whitesource.agent.report.PolicyCheckReport (Application)
  -> com.fasterxml.jackson.databind.ObjectMapper (Extension)
   -> com.fasterxml.jackson.databind.ObjectReader (Extension)
    -> ❌ com.fasterxml.jackson.databind.deser.std.StdDeserializer (Vulnerable Component)

Vulnerability Details

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

Publish Date: 2022-10-02

URL: CVE-2022-42003

CVSS 4 Score Details (8.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

For more information on CVSS4 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#3590

Release Date: 2022-10-02

Fix Resolution: 2.13.4.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-42004

Vulnerable Library - jackson-databind-2.13.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /wss-agent-report/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.13.3/jackson-databind-2.13.3.jar

Dependency Hierarchy:

• ❌ jackson-databind-2.13.3.jar (Vulnerable Library)

Found in base branches: integration, master

Reachability Analysis

This vulnerability is potentially reachable

org.whitesource.agent.report.PolicyCheckReport (Application)
  -> com.fasterxml.jackson.databind.json.JsonMapper (Extension)
   -> ❌ com.fasterxml.jackson.databind.deser.BeanDeserializer (Vulnerable Component)

Vulnerability Details

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Publish Date: 2022-10-02

URL: CVE-2022-42004

CVSS 4 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

For more information on CVSS4 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#3582

Release Date: 2022-10-02

Fix Resolution: 2.13.4

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.