Maven/com.fasterxml.jackson.core:jackson-databind: medium 6.5
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
Action: Upgrade com.fasterxml.jackson.core:jackson-databind to 2.18.9 (2.18.x) or 2.21.5 (2.21.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.18.0 | 2.18.9 | - |
| 2.21.0 | 2.21.5 | - |
Fixed versions
| 2.18.9 | 2.21.5 |
Sources
- osv: GHSA-mhm7-754m-9p8w
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w
- https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed
- https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c
- https://github.com/FasterXML/jackson-databind
published · modified · JSON