CVE-2022-42003

一、漏洞信息
 漏洞编号：[CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003)
 漏洞归属组件：[jackson-databind](https://gitee.com/src-openeuler/jackson-databind)
 漏洞归属的版本：2.14.0,2.9.8
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
 漏洞公开时间：2022-10-02 13:15:09
 漏洞创建时间：2022-10-05 10:40:20
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-42003
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 |  |
| cve.mitre.org | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  |
| cve.mitre.org | https://github.com/FasterXML/jackson-databind/issues/3590 |  |
| cve.mitre.org | https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html |  |
| cve.mitre.org | https://security.gentoo.org/glsa/202210-21 |  |
| cve.mitre.org | https://security.netapp.com/advisory/ntap-20221124-0004/ |  |
| cve.mitre.org | https://www.debian.org/security/2022/dsa-5283 |  |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| suse_bugzilla | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-42003 | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-42003 | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| suse_bugzilla | https://github.com/FasterXML/jackson-databind/issues/3590 | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| suse_bugzilla | http://www.cvedetails.com/cve/CVE-2022-42003/ | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| suse_bugzilla | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 | https://bugzilla.suse.com/show_bug.cgi?id=1204370 |
| redhat_bugzilla | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://github.com/FasterXML/jackson-databind/issues/3590 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:7435 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:8876 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:8781 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:8889 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:9023 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:9032 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0189 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0264 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0469 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0471 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0553 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0552 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0554 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0556 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-42003 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:0713 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1043 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1044 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1045 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1047 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1049 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1064 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:1006 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:2097 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:2100 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:2135 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:3223 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:3641 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:3663 | https://bugzilla.redhat.com/show_bug.cgi?id=2135244 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003 | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://github.com/FasterXML/jackson-databind/issues/3590 | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 (jackson-databind-2.14.0-rc1) | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-42003 | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-42003 | https://ubuntu.com/security/CVE-2022-42003 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-42003 | https://ubuntu.com/security/CVE-2022-42003 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2022-42003 |
| oracle |  | https://www.oracle.com/security-alerts/cpujan2023.html |
| gentoo |  | https://security.gentoo.org/glsa/202210-21 |
| cve_search |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |
| cve_search |  | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 |
| cve_search |  | https://github.com/FasterXML/jackson-databind/issues/3590 |
| cve_search |  | https://security.gentoo.org/glsa/202210-21 |
| cve_search |  | https://www.debian.org/security/2022/dsa-5283 |
| cve_search |  | https://security.netapp.com/advisory/ntap-20221124-0004/ |
| cve_search |  | https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html |
| gradle |  | https://security.gradle.com/advisory/2022-15 |
| github_advisory | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://nvd.nist.gov/vuln/detail/CVE-2022-42003 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/blob/2.13/release-notes/VERSION-2.x | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://security.gentoo.org/glsa/202210-21 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://security.netapp.com/advisory/ntap-20221124-0004/ | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/commits/jackson-databind-2.4.0-rc1?after=75b97b8519f0d50c62523ad85170d80a197a2c86+174&branch=jackson-databind-2.4.0-rc1&qualified_name=refs%2Ftags%2Fjackson-databind-2.4.0-rc1 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.13.4.1...jackson-databind-2.13.4.2 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://www.debian.org/security/2022/dsa-5283 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/issues/3590 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| github_advisory | https://github.com/FasterXML/jackson-databind/issues/3627 | https://github.com/advisories/GHSA-jjjh-jjxp-wpff |
| osv | https://nvd.nist.gov/vuln/detail/CVE-2022-42003 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/issues/3590 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/issues/3627 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/blob/2.13/release-notes/VERSION-2.x | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/commits/jackson-databind-2.4.0-rc1?after=75b97b8519f0d50c62523ad85170d80a197a2c86+174&amp;branch=jackson-databind-2.4.0-rc1&amp;qualified_name=refs%2Ftags%2Fjackson-databind-2.4.0-rc1 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.13.4.1...jackson-databind-2.13.4.2 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://security.gentoo.org/glsa/202210-21 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://security.netapp.com/advisory/ntap-20221124-0004/ | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| osv | https://www.debian.org/security/2022/dsa-5283 | https://osv.dev/vulnerability/GHSA-jjjh-jjxp-wpff |
| aliyun | https://www.oracle.com/security-alerts/cpujan2023.html | https://cert.360.cn/warning/detail?id=001cb5ec0d56c817ed6202004b6ba384 |
| nvd | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | cve.mitre.org |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | suse_bugzilla |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | redhat_bugzilla |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 (jackson-databind-2.14.0-rc1) |  | ubuntu |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | ubuntu |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | github_advisory |
|  |  | https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc |  | github_advisory |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45 |  | github_advisory |
|  |  | https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1 |  | github_advisory |
|  |  | https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea |  | github_advisory |
|  |  | https://github.com/FasterXML/jackson-databind/commit/0e37a39502439ecbaa1a5b5188387c01bf7f7fa1 |  | osv |
|  |  | https://github.com/FasterXML/jackson-databind/commit/7ba9ac5b87a9d6ac0d2815158ecbeb315ad4dcdc |  | osv |
|  |  | https://github.com/FasterXML/jackson-databind/commit/cd090979b7ea78c75e4de8a4aed04f7e9fa8deea |  | osv |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d499f2e7bbc5ebd63af11e1f5cf1989fa323aa45 |  | osv |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | osv |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | nvd |
|  |  | https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33 |  | cve_search |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
      In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.  
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(2.9.8):受影响
2.openEuler-20.03-LTS-SP3(2.9.8):受影响
3.openEuler-20.03-LTS-SP4:受影响
4.openEuler-22.03-LTS(2.9.8):受影响
5.openEuler-22.03-LTS-SP1(2.9.8):受影响
6.openEuler-22.03-LTS-SP2(2.9.8):受影响
7.openEuler-22.03-LTS-SP3:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(2.9.8):否
2.openEuler-20.03-LTS-SP3(2.9.8):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(2.9.8):否
5.openEuler-22.03-LTS-SP1(2.9.8):否
6.openEuler-22.03-LTS-SP2(2.9.8):否
7.openEuler-22.03-LTS-SP3:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1971

src-openEuler/jackson-databind

内容风险标识

评论 (15)

src-openEuler/jackson-databind .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-42003

评论 (15)

搜索帮助

src-openEuler/jackson-databind