CVE-2019-12384: Deserialization of Untrusted Data in FasterXML jackson-databind

(updated )

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

References

Code Behaviors & Features

Detect and mitigate CVE-2019-12384 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →