In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
0848F177-1977-4C9C-B91A-7374FF25F335
2.12.7.1
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
2BB48E8E-EB2F-46D1-BD98-982FB3528273
2.13.4
2.13.0
OR
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
5CA36870-3A63-428D-BC49-4924FF75FAAD
2.13.0
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
FA6FEEC2-9F11-4643-8827-749718254FED
OR
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
OR
Fix included in

* 2.13.4
* 2.12.7.1 micro-patch (jackson-bom 2.12.7.20221012)

----

(note: found by oss-fuzz, see: https://bugs.chromium.org/p/oss-fuzz/issues)

Currently feature `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS` is supported by most types, and deserializers tend to implement support using recursion, effectively allowing multiple nested layers of JSON Arrays to be unwrapped.
This is not a feature to support but just an implementation detail; ideally we should only allow a single JSON Array to wrap a value.

I think I have removed ability for deeper nesting from some other types so there may be some prior art.


Add check in `BeanDeserializer._deserializeFromArray()` to prevent use of deeply nested arrays [CVE-2022-42004]
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Add check in `BeanDeserializer._deserializeFromArray()` to prevent use of deeply nested arrays [CVE-2022-42004]
Issue date:

--- start body ---
Fix included in

* 2.13.4
* 2.12.7.1 micro-patch (jackson-bom 2.12.7.20221012)

----

(note: found by oss-fuzz, see: https://bugs.chromium.org/p/oss-fuzz/issues)

Currently feature `DeserializationFeature.UNWRAP_SINGLE_VALUE_ARRAYS` is supported by most types, and deserializers tend to implement support using recursion, effectively allowing multiple nested layers of JSON Arrays to be unwrapped.
This is not a feature to support but just an implementation detail; ideally we should only allow a single JSON Array to wrap a value.

I think I have removed ability for deeper nesting from some other types so there may be some prior art.


--- end body ---

comments :
--- start comments ---

--- end comments ---