Skip to content
This repository has been archived by the owner on Sep 21, 2021. It is now read-only.

WS-2018-0124 Medium Severity Vulnerability detected by WhiteSource #13

Closed
mend-bolt-for-github bot opened this issue Dec 9, 2018 · 0 comments
Closed

WS-2018-0124 Medium Severity Vulnerability detected by WhiteSource #13

mend-bolt-for-github bot opened this issue Dec 9, 2018 · 0 comments
Labels
security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link
Contributor

WS-2018-0124 - Medium Severity Vulnerability

Vulnerable Library - Jackson-core-2.2.3.jar

Core Jackson abstractions, basic JSON streaming API implementation

path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.2.3/jackson-core-2.2.3.jar

Library home page: http://wiki.fasterxml.com/JacksonHome

Dependency Hierarchy:

  • geoip2-0.7.1.jar (Root Library)
    • jackson-databind-2.2.3.jar
      • ❌ Jackson-core-2.2.3.jar (Vulnerable Library)

Vulnerability Details

In Jackson Core before version 2.8.6 if the REST endpoint consumes POST requests with JSON or XML data and data are invalid, the first unrecognized token is printed to server.log. If the first token is word of length 10MB, the whole word is printed. This is potentially dangerous and can be used to attack the server by filling the disk with logs.

Publish Date: 2018-06-24

URL: WS-2018-0124

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Step up your Open Source Security Game with WhiteSource here
@mend-bolt-for-github mend-bolt-for-github bot added the security vulnerability Security vulnerability detected by WhiteSource label Dec 9, 2018
ghost pushed a commit that referenced this issue Dec 10, 2018
Update MaxMind GeoIP2 API, fixes GH-2, GH-3, GH-4, GH-5, GH-6, GH-7,
c75734c 
GH-8, GH-9, GH-10, GH-11, GH-12, GH-13 and GH-14
@ghost ghost closed this as completed Dec 10, 2018
ghost pushed a commit that referenced this issue Sep 21, 2021
Update MaxMind GeoIP2 API, fixes GH-2, GH-3, GH-4, GH-5, GH-6, GH-7,
0a4a046 
GH-8, GH-9, GH-10, GH-11, GH-12, GH-13 and GH-14
This issue was closed.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants