sonatype-2022-6438 Security Details

CVE ID

sonatype-2022-6438

CWE

N/A

CVE Description

jackson-core - Denial of Service (DoS)

Published

Dec 7, 2022

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/fasterxml/jackson/core/base/ParserBase._parseSlowInt(I)V

JVMVulnerable params: 0

com/fasterxml/jackson/core/base/ParserBase.convertNumberToBigDecimal()V

JVM

com/fasterxml/jackson/core/base/ParserMinimalBase.getValueAsDouble(D)D

JVMVulnerable params: 0

com/fasterxml/jackson/core/util/TextBuffer.contentsAsDecimal()Ljava/math/BigDecimal;

JVM

com/fasterxml/jackson/core/util/TextBuffer.contentsAsDouble(Z)D

JVM

com/fasterxml/jackson/core/util/TextBuffer.contentsAsFloat(Z)F

JVM

Affected Ecosystems

affected

Source

Sonatype

References

https://github.com/FasterXML/jackson-core/pull/827PROJECT

https://github.com/FasterXML/jackson-core/pull/846PROJECT