[TOMEE-4227] Jackson 2.15.2

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.0.15, 9.1.0
• Fix Version/s: 10.0.0-M1, 8.0.16, 9.1.1
• Component/s: TomEE Core Server
• Labels: cve
• Assignee: Richard Zowalla
• Reporter: Nikhil
• Created: 28/Jun/23 03:50
• Updated: 11/Nov/23 07:42
• Resolved: 28/Jun/23 06:50

Description

Vulnerability Details

CVE-2023-35116

Summary: An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that the product is not intended for use with untrusted input.

Issue Links

• is a clone of: TOMEE-4216 Jackson 2.15.1