Hide Forgot
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. https://github.com/FasterXML/jackson-databind/issues/3582 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50490 https://github.com/FasterXML/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88
Created jackson-databind tracking bugs for this issue: Affects: fedora-all [bug 2135250]
This issue has been addressed in the following products: Logging subsystem for Red Hat OpenShift 5.4 Via RHSA-2022:7435 https://access.redhat.com/errata/RHSA-2022:7435
This issue has been addressed in the following products: Red Hat JBoss AMQ Via RHSA-2022:8876 https://access.redhat.com/errata/RHSA-2022:8876
This issue has been addressed in the following products: RHOL-5.5-RHEL-8 Via RHSA-2022:8781 https://access.redhat.com/errata/RHSA-2022:8781
This issue has been addressed in the following products: OpenShift Logging 5.3 Via RHSA-2022:8889 https://access.redhat.com/errata/RHSA-2022:8889
This issue has been addressed in the following products: Red Hat build of Quarkus 2.13.5 Via RHSA-2022:9023 https://access.redhat.com/errata/RHSA-2022:9023
This issue has been addressed in the following products: Red Hat build of Eclipse Vert.x 4.3.4 Via RHSA-2022:9032 https://access.redhat.com/errata/RHSA-2022:9032
This issue has been addressed in the following products: Red Hat AMQ Streams 2.3.0 Via RHSA-2023:0189 https://access.redhat.com/errata/RHSA-2023:0189
This issue has been addressed in the following products: RHOL-5.6-RHEL-8 Via RHSA-2023:0264 https://access.redhat.com/errata/RHSA-2023:0264
This issue has been addressed in the following products: RHINT Camel-Q 2.13.2 Via RHSA-2023:0469 https://access.redhat.com/errata/RHSA-2023:0469
This issue has been addressed in the following products: Migration Toolkit for Runtimes 1 on RHEL 8 Via RHSA-2023:0471 https://access.redhat.com/errata/RHSA-2023:0471
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2023:0553 https://access.redhat.com/errata/RHSA-2023:0553
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2023:0552 https://access.redhat.com/errata/RHSA-2023:0552
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Via RHSA-2023:0554 https://access.redhat.com/errata/RHSA-2023:0554
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2023:0556 https://access.redhat.com/errata/RHSA-2023:0556
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-42004