In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
0848F177-1977-4C9C-B91A-7374FF25F335
2.12.7.1
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
A2BBD219-927A-40F3-9AFE-C6A8E7F3E26B
2.13.4.1
2.13.0
OR
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
DA172A0D-FB5E-4754-BB9F-3DEC3366E6F8
2.13.3
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
FA6FEEC2-9F11-4643-8827-749718254FED
OR
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
OR
TL;DNR:

Fix included in:

* 2.14.0 once released (until then, 2.14.0-rc1 and rc2)
* 2.13.4.2 micro-patch (jackson-bom 2.13.4.20221013). (NOTE: 2.13.4.1/2.13.4.20221012 have an issue that affects Gradle users)
* 2.12.7.1 micro-patch  (jackson-bom 2.12.7.20221012)

-----

(note: similar to #3582 )
(note: originally found via oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020)

Implementation of methods like `_parseBooleanPrimitive` (in `StdDeserializer`) uses idiom:

```
            if (ctxt.isEnabled(DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS)) {
                p.nextToken();
                final boolean parsed = _parseBooleanPrimitive(p, ctxt);
                _verifyEndArrayForSingle(p, ctxt);
                return parsed;
            }
```

to handle unwrapping. While simple this exposes possibility of "too deep" nesting and possible problem with resource exhaustion in some cases. We should change this similar to how #3582 was handled.



Add check in primitive value deserializers to avoid deep wrapper array nesting wrt `UNWRAP_SINGLE_VALUE_ARRAYS` [CVE-2022-42003]
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Add check in primitive value deserializers to avoid deep wrapper array nesting wrt `UNWRAP_SINGLE_VALUE_ARRAYS` [CVE-2022-42003]
Issue date:

--- start body ---
TL;DNR:

Fix included in:

* 2.14.0 once released (until then, 2.14.0-rc1 and rc2)
* 2.13.4.2 micro-patch (jackson-bom 2.13.4.20221013). (NOTE: 2.13.4.1/2.13.4.20221012 have an issue that affects Gradle users)
* 2.12.7.1 micro-patch  (jackson-bom 2.12.7.20221012)

-----

(note: similar to #3582 )
(note: originally found via oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020)

Implementation of methods like `_parseBooleanPrimitive` (in `StdDeserializer`) uses idiom:

```
            if (ctxt.isEnabled(DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS)) {
                p.nextToken();
                final boolean parsed = _parseBooleanPrimitive(p, ctxt);
                _verifyEndArrayForSingle(p, ctxt);
                return parsed;
            }
```

to handle unwrapping. While simple this exposes possibility of "too deep" nesting and possible problem with resource exhaustion in some cases. We should change this similar to how #3582 was handled.



--- end body ---

comments :
--- start comments ---

--- end comments ---