jackson-datatype-jsr310-2.10.1.jar: 7 vulnerabilities (highest severity is: 7.5)

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - jackson-datatype-jsr310-2.10.1.jar</summary>


Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar



Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a></details>

## Vulnerabilities

| CVE | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Dependency | Type | Fixed in (jackson-datatype-jsr310 version) | Remediation Possible** |
| ------------- | ------------- | ----- | ----- | ----- | ------------- | --- |
| [WS-2022-0468](https://github.com/FasterXML/jackson-core/issues/861) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-core-2.10.1.jar | Transitive | 2.10.2 | &#9989; |
| [CVE-2022-42004](https://www.mend.io/vulnerability-database/CVE-2022-42004) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.10.1.jar | Transitive | 2.10.2 | &#9989; |
| [CVE-2022-42003](https://www.mend.io/vulnerability-database/CVE-2022-42003) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.10.1.jar | Transitive | 2.10.2 | &#9989; |
| [CVE-2021-46877](https://www.mend.io/vulnerability-database/CVE-2021-46877) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.10.1.jar | Transitive | 2.10.2 | &#9989; |
| [CVE-2020-36518](https://www.mend.io/vulnerability-database/CVE-2020-36518) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.10.1.jar | Transitive | 2.10.2 | &#9989; |
| [CVE-2020-25649](https://www.mend.io/vulnerability-database/CVE-2020-25649) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | jackson-databind-2.10.1.jar | Transitive | 2.10.2 | &#9989; |
| [WS-2021-0616](https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.9 | detected in multiple dependencies | Transitive | 2.10.2 | &#9989; |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2022-0468</summary>


### Vulnerable Library - jackson-core-2.10.1.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-core-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main




### Vulnerability Details
 
 
The jackson-core package is vulnerable to a Denial of Service (DoS) attack. The methods in the classes listed below fail to restrict input size when performing numeric type conversions. A remote attacker can exploit this vulnerability by causing the application to deserialize data containing certain numeric types with large values. Deserializing many of the aforementioned objects may cause the application to exhaust all available resources, resulting in a DoS condition.

Publish Date: 2022-12-07
URL: <a href=https://github.com/FasterXML/jackson-core/issues/861>WS-2022-0468</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-12-07
Fix Resolution (com.fasterxml.jackson.core:jackson-core): 2.15.0-rc1
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-42004</summary>


### Vulnerable Library - jackson-databind-2.10.1.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webwolf/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main




### Vulnerability Details
 
 
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Publish Date: 2022-10-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-42004>CVE-2022-42004</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-10-02
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.7.1
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-42003</summary>


### Vulnerable Library - jackson-databind-2.10.1.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webwolf/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main




### Vulnerability Details
 
 
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
 Mend Note: For 2.13.4.x, the vulnerability is fixed in 2.13.4.1. A micro-patch was added in 2.13.4.2 to address issues for Gradle users. 

Publish Date: 2022-10-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-42003>CVE-2022-42003</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-jjjh-jjxp-wpff">https://github.com/advisories/GHSA-jjjh-jjxp-wpff</a>
Release Date: 2022-10-02
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.7.1
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2021-46877</summary>


### Vulnerable Library - jackson-databind-2.10.1.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webwolf/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main




### Vulnerability Details
 
 
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Publish Date: 2023-03-18
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2021-46877>CVE-2021-46877</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.cve.org/CVERecord?id=CVE-2021-46877">https://www.cve.org/CVERecord?id=CVE-2021-46877</a>
Release Date: 2023-03-18
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-36518</summary>


### Vulnerable Library - jackson-databind-2.10.1.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webwolf/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main




### Vulnerability Details
 
 
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
 Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.

Publish Date: 2022-03-11
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-36518>CVE-2020-36518</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-03-11
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6.1
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2020-25649</summary>


### Vulnerable Library - jackson-databind-2.10.1.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webwolf/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main




### Vulnerability Details
 
 
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Publish Date: 2020-12-03
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-25649>CVE-2020-25649</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: High
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2020-12-03
Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.10.5.1
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> WS-2021-0616</summary>


### Vulnerable Libraries - jackson-core-2.10.1.jar, jackson-databind-2.10.1.jar



### jackson-core-2.10.1.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.10.1/jackson-core-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-core-2.10.1.jar** (Vulnerable Library)


### jackson-databind-2.10.1.jar

General data-binding functionality for Jackson: works on core streaming API
Library home page: <a href="http://fasterxml.com/">http://fasterxml.com/</a>
Path to dependency file: /webwolf/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar,/home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar


Dependency Hierarchy:
 - jackson-datatype-jsr310-2.10.1.jar (Root Library)
 - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)


Found in HEAD commit: <a href="https://github.com/feemstr/WebGoat_2.0_8.1.0/commit/0a9333ddb56c20579d3dc182cdf741a918259c21">0a9333ddb56c20579d3dc182cdf741a918259c21</a>
Found in base branch: main






### Vulnerability Details
 
 
FasterXML jackson-databind before 2.12.6 and 2.13.1 there is DoS when using JDK serialization to serialize JsonNode.

Publish Date: 2021-11-20
URL: <a href=https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb>WS-2021-0616</a>




### CVSS 3 Score Details (5.9)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2021-11-20
Fix Resolution (com.fasterxml.jackson.core:jackson-core): 2.12.6
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2Fix Resolution (com.fasterxml.jackson.core:jackson-databind): 2.12.6
Direct dependency fix Resolution (com.fasterxml.jackson.datatype:jackson-datatype-jsr310): 2.10.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details>

***

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

CVE	Severity	CVSS	Dependency	Type	Fixed in (jackson-datatype-jsr310 version)	Remediation Possible**
WS-2022-0468	High	7.5	jackson-core-2.10.1.jar	Transitive	2.10.2	✅
CVE-2022-42004	High	7.5	jackson-databind-2.10.1.jar	Transitive	2.10.2	✅
CVE-2022-42003	High	7.5	jackson-databind-2.10.1.jar	Transitive	2.10.2	✅
CVE-2021-46877	High	7.5	jackson-databind-2.10.1.jar	Transitive	2.10.2	✅
CVE-2020-36518	High	7.5	jackson-databind-2.10.1.jar	Transitive	2.10.2	✅
CVE-2020-25649	High	7.5	jackson-databind-2.10.1.jar	Transitive	2.10.2	✅
WS-2021-0616	Medium	5.9	detected in multiple dependencies	Transitive	2.10.2	✅

jackson-datatype-jsr310-2.10.1.jar: 7 vulnerabilities (highest severity is: 7.5) #78

Description

Vulnerabilities

Details

Vulnerable Library - jackson-core-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jackson-databind-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jackson-databind-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jackson-databind-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jackson-databind-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - jackson-databind-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Libraries - jackson-core-2.10.1.jar, jackson-databind-2.10.1.jar

jackson-core-2.10.1.jar

jackson-databind-2.10.1.jar

Vulnerability Details

CVSS 3 Score Details (5.9)

Suggested Fix

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions