[CASSANDRA-17556] jackson-databind 2.13.2 is vulnerable to CVE-2020-36518

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.11.13, 4.0.4, 4.1-alpha1, 4.1
• Component/s: Build
• Bug Category: Security - Denial of Service
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: 4.0.3

Source Control Link

https://github.com/apache/cassandra/commit/4bb1a07b5be16b35d33ef5a4645a1209dffa9759

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 13/Apr/22 19:22
• Updated: 27/May/22 19:25
• Resolved: 28/Apr/22 14:13

Description

Seems like it's technically possible to cause a DoS with nested json.