{"action":"Upgrade org.springframework.security:spring-security-core to 4.2.3.RELEASE (4.x) or 5.0.0.M2 (5.x) or later.","affected":[{"fixed":"4.2.3.RELEASE","introduced":"4.2.0.RELEASE"},{"fixed":"5.0.0.M2","introduced":"5.0.0.M1"}],"component":"org.springframework.security:spring-security-core","cve_ids":["CVE-2017-4995"],"ecosystem":"Maven","epss":0.02547,"exploited":false,"fixed_versions":["4.2.3.RELEASE","5.0.0.M2"],"ghsa_id":"GHSA-vhrg-v3cv-p247","id":"tcs_01M5N9E4W3QW946XNXFKR211TE","modified_at":"2024-03-05T22:16:02.821772Z","published_at":"2022-05-13T01:02:16Z","references":["https://osv.dev/vulnerability/GHSA-vhrg-v3cv-p247","https://nvd.nist.gov/vuln/detail/CVE-2017-4995","https://github.com/FasterXML/jackson-databind/issues/1599","https://github.com/spring-projects/spring-security/issues/4370","https://github.com/FasterXML/jackson-databind/commit/60d459cedcf079c6106ae7da2ac562bc32dcabe1","https://github.com/FasterXML/jackson-databind/commit/6ce32ffd18facac6abdbbf559c817b47fcb622c","https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c@%3Ccommits.cassandra.apache.org%3E","https://pivotal.io/security/cve-2017-4995"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-vhrg-v3cv-p247","url":"https://osv.dev/vulnerability/GHSA-vhrg-v3cv-p247"}],"summary":"Deserialization of Untrusted Data in Spring Security"}