[
https://issues.apache.org/jira/browse/TOMEE-4227?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla closed TOMEE-4227.
----------------------------------
Fix Version/s: (was: 10.0.0-M1)
(was: 8.0.16)
(was: 9.1.1)
Resolution: Fixed
> Jackson 2.15.2
> --------------
>
> Key: TOMEE-4227
> URL: https://issues.apache.org/jira/browse/TOMEE-4227
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Affects Versions: 8.0.15, 9.1.0
> Reporter: Nikhil
> Assignee: Richard Zowalla
> Priority: Major
> Labels: cve
> Fix For: 10.0.0
>
>
> h1. Vulnerability Details
> h2. CVE-2023-35116
> {*}Summary{*}: An issue was discovered jackson-databind thru 2.15.2 allows
> attackers to cause a denial of service or other unspecified impacts via
> crafted object that uses cyclic dependencies. NOTE: the vendor's perspective
> is that the product is not intended for use with untrusted input.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
