Vulnerability identifier: #VU61799

Vulnerability risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-36518

CWE-ID: CWE-787

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
jackson-databind
Universal components / Libraries / Libraries used by multiple products

Vendor: FasterXML

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can trigger out-of-bounds write and cause a denial of service condition on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

jackson-databind: 2.12.0 - 2.12.6, 2.13.0 - 2.13.2

---

CPE

• cpe:2.3:a:fasterxml:jackson-databind:2.12.6:*:*:*:*:*:*:*

External links
http://github.com/FasterXML/jackson-databind/issues/2816
http://github.com/advisories/GHSA-57j2-w4cx-62h2

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?