jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
E4445932-0923-4D28-8911-CFC9B61DFE2B
2.12.6.1
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
862ED616-15D6-42A2-88DB-9D3F304EFB5D
2.13.2.1
2.13.0
OR
cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*
384DEDD9-CB26-4306-99D8-83068A9B23ED
23.1
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
5FA64A1D-34F9-4441-857A-25C165E6DBB6
cpe:2.3:a:oracle:commerce_platform:11.3.0:*:*:*:*:*:*:*
57DA1DD8-E9F1-43C6-BCA2-1E9C92B1664C
cpe:2.3:a:oracle:commerce_platform:11.3.1:*:*:*:*:*:*:*
869CDD22-4A6C-4665-AA37-E340B07EF81C
cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:*
8CDE72F7-ED9D-4A53-BF63-DF6711FFDEF4
cpe:2.3:a:oracle:communications_billing_and_revenue_management:*:*:*:*:*:*:*:*
DCE2010E-A144-4ED2-B73D-1CA3800A8F71
12.0.0.6.0
12.0.0.4.0
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
6EDB6772-7FDB-45FF-8D72-952902A7EE56
cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*
DAAB7154-4DE8-4806-86D0-C1D33B84417B
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*
A264E0DE-209D-49B1-8B26-51AB8BBC97F1
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*
EBB5FF32-7362-4A1E-AD24-EF6B8770FCAD
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.0:*:*:*:*:*:*:*
D6577F14-36B6-46A5-A1B1-FCCADA61A23B
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:22.1.1:*:*:*:*:*:*:*
4F4637E5-3324-441D-94E9-C2DBE9A6B502
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*
8B40FAF9-0A6B-41C4-8CAD-D3D1DD982C2C
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:22.2.0:*:*:*:*:*:*:*
C4E817B5-A26B-4EA8-BA93-F87F42114FF4
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:*
74810125-09E6-4F27-B541-AFB61112AC56
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
69F21EC6-EC2F-4E96-A9DE-621B84105304
8.1.0.0
8.0.7
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1.0:*:*:*:*:*:*:*
3CC69CF0-6269-40F5-871B-16CFD5EC4C45
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.0:*:*:*:*:*:*:*
172BECE8-9626-4910-AAA1-A2FA9C7139E3
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.1:*:*:*:*:*:*:*
ACB82398-7281-47CF-81F9-A8A67D9C9DFE
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*
AD9AC3A6-9B91-4B55-A320-A40E95F21058
8.1.2.1
8.1.1.0
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.7.0.0:*:*:*:*:*:*:*
F9319627-379D-4069-8AC9-512D411F22DA
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8:*:*:*:*:*:*:*
1AC36036-07CE-4903-8FFB-445C6908F0CE
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*
55F091C7-0869-4FD6-AC73-DA697D990304
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*
4D134C60-F9E2-46C2-8466-DB90AD98439E
cpe:2.3:a:oracle:financial_services_enterprise_case_management:*:*:*:*:*:*:*:*
E6F77FFB-558E-4740-A63E-B702EE12EF68
8.1.2.1
8.1.1.0
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*
C64D669C-513E-4C53-8BB8-13EB336CDC3A
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:*
D4BDDBCD-4038-4BEC-91DB-587C2FBC6369
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*
F6394E90-2F2C-4955-9F97-BFED76D4333B
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*
5B5DC0C1-789B-4126-8C6D-DEDE83AA2D2E
cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.7:*:*:*:enterprise:*:*:*
B57ECC6E-CC64-4DE7-B657-3BA54EDDFFF4
cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8:*:*:*:enterprise:*:*:*
10BBAD37-51A1-4819-807B-2642E9D4A69C
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:*:*:*:*:*:*:*:*
EE85204F-614D-4EF1-ABEB-B3CD381C2CB0
13.9.4.2.2
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
5A6FFB5C-EB44-499F-BE81-24ED2B1F201A
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
8F0728F8-14D0-4282-9CA7-EFCD68EE77AF
12.2.0.1.30
cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:*
097A31AB-B77F-4DC5-9CD8-AC3A403607AA
22.2.0
cpe:2.3:a:oracle:health_sciences_empirica_signal:9.1.0.5.2:*:*:*:*:*:*:*
42F4D251-489F-41C8-BFA3-B51A1B69028D
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
C8AF00C6-B97F-414D-A8DF-057E6BFD8597
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
8B1C88FD-C2EC-4C96-AC7E-6F95C8763B48
17.12.11
17.12.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
F04DF183-EBCB-456E-90F9-A8500E6E32B7
18.8.14
18.8.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
8D30B0D1-4466-4601-8822-CE8ADBB381FB
19.12.13
19.12.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
17DE4709-5FFB-4E70-9416-553D89149D51
20.12.18
20.12.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
2982311E-B89A-4F9A-8BD2-44635DDDC10B
21.12.1
21.12.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
050C3F61-FD74-4B62-BBC7-FFF05B22FB34
17.12.20.4
17.12.0.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
CD0A17FC-BFA9-4EA5-8D4F-1CEC5BC11AA7
18.8.25.4
18.8.0.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
5BC6277C-7C2F-49E1-8A68-4C726A087F74
19.12.19.0
19.12.0
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
C383F1DE-32E0-4E77-9C5F-2D91893F458E
21.12.4.0
20.12.0.0
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
5AFBEE29-1972-40B1-ADD6-536D5C74D4EA
17.12
17.0
cpe:2.3:a:oracle:primavera_unifier:18.0:*:*:*:*:*:*:*
951EC479-1B04-49C9-8381-D849685E7517
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
10864586-270E-4ACF-BDCC-ECFCD299305F
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
38340E3C-C452-4370-86D4-355B6B4E0A06
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*
E9C55C69-E22E-4B80-9371-5CD821D79FE2
cpe:2.3:a:oracle:retail_sales_audit:15.0.3.1:*:*:*:*:*:*:*
5B32D7B0-CAE2-4B31-94C4-6124356C12B2
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*
77E39D5C-5EFA-4FEB-909E-0A92004F2563
cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*
06816711-7C49-47B9-A9D7-FB18CC3F42F2
cpe:2.3:a:oracle:spatial_studio:*:*:*:*:*:*:*:*
7E244A7B-EB39-4A84-BB01-EB09037A701F
20.1.0
cpe:2.3:a:oracle:utilities_framework:4.3.0.5.0:*:*:*:*:*:*:*
A5BBA303-8D2B-48C5-B52A-4E192166699C
cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:*
8DF02546-3F0D-4FDD-89B1-8A3FE43FB5BF
cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
3F906F04-39E4-4BE4-8A73-9D058AAADB43
cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*
7B393A82-476A-4270-A903-38ED4169E431
cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:*
85CAE52B-C2CA-4C6B-A0B7-2B9D6F0499E2
cpe:2.3:a:oracle:utilities_framework:4.4.0.5.0:*:*:*:*:*:*:*
B4DAAD73-FE86-4934-AB1A-A60E840C6C1E
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
F14A818F-AA16-4438-A3E4-E64C9287AC66
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
04BCDC24-4A21-473C-8733-0D9CFB38A752
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
FA6FEEC2-9F11-4643-8827-749718254FED
OR
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
F3E0B672-3E06-4422-B2A4-0BD073AEC2A1
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
3A756737-1CC4-42C2-A4DF-E1C893B4E2D5
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
B55E8D50-99B4-47EC-86F9-699B67D473CE
cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*
CCAA4004-9319-478C-9D55-0E8307F872F6
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
F1BE6C1F-2565-4E97-92AA-16563E5660A5
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
9F4754FB-E3EB-454A-AB1A-AE3835C5350C
OR
**EDIT**: related to to CVE-2020-36518 (see https://nvd.nist.gov/vuln/detail/CVE-2020-36518)

**EDIT**: Fix included in

* 2.14.0
* 2.13.3:
    * Was also included  in 2.13.2.1 and 2.13.2.2 (see https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13); to be used with `jackson-bom` version `2.13.2.20220328`
* 2.12.6.1: (see https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12)
    * use with `jackson-bom` version `2.12.6.1.20220326`

**EDIT**: included as one of Snyk's "top-10 vulns of 2022" CVEs -- see https://go.snyk.io/snyk-top-10-open-source-vulnerabilities-dwn-typ.html

-----

Current implementation `UntypedObjectDeserializer` is relatively expensive for deeply nested Object and Array values as it uses recursion even for "vanilla" case (one where there are no custom `List`/array or `Map` deserializers).
In practical terms it is possible to exhaust typical modest JVM memory with documents having about ten thousand levels of nestings, due to size of call stack from recursive calls.

*NOTE*: specifically this ONLY APPLIES if the target type is "untyped" or generic `Collection<Object>` / `Map<String, Object>` -- it DOES NOT APPLY to cases where target is POJO (except if POJO itself has "untyped" property or properties).

Similar issue was already solved wrt `JsonNode` (see #3397), included in 2.13.0; this might show a way to approach this problem: by replacing simple recursion with iteration, either completely or at some inner levels.

Also note that it may ultimately be necessary to have lower-level constraints for streaming parser too, see: https://github.com/FasterXML/jackson-core/issues/637

Ideally it should be:

1. Possible to handle at least tens of thousands of levels of nesting (100k should be processable with 256M heap, say)
2. Have streaming level limits that -- by default -- block documents with more than limit we deem safe (less than 100k -- perhaps 10k or something, to be determined).

This issue is specifically about (1) as (2) is about `jackson-core`.

Optimize `UntypedObjectDeserializer` wrt recursion [CVE-2020-36518]
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Optimize `UntypedObjectDeserializer` wrt recursion [CVE-2020-36518]
Issue date:

--- start body ---
**EDIT**: related to to CVE-2020-36518 (see https://nvd.nist.gov/vuln/detail/CVE-2020-36518)

**EDIT**: Fix included in

* 2.14.0
* 2.13.3:
    * Was also included  in 2.13.2.1 and 2.13.2.2 (see https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13); to be used with `jackson-bom` version `2.13.2.20220328`
* 2.12.6.1: (see https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12)
    * use with `jackson-bom` version `2.12.6.1.20220326`

**EDIT**: included as one of Snyk's "top-10 vulns of 2022" CVEs -- see https://go.snyk.io/snyk-top-10-open-source-vulnerabilities-dwn-typ.html

-----

Current implementation `UntypedObjectDeserializer` is relatively expensive for deeply nested Object and Array values as it uses recursion even for "vanilla" case (one where there are no custom `List`/array or `Map` deserializers).
In practical terms it is possible to exhaust typical modest JVM memory with documents having about ten thousand levels of nestings, due to size of call stack from recursive calls.

*NOTE*: specifically this ONLY APPLIES if the target type is "untyped" or generic `Collection<Object>` / `Map<String, Object>` -- it DOES NOT APPLY to cases where target is POJO (except if POJO itself has "untyped" property or properties).

Similar issue was already solved wrt `JsonNode` (see #3397), included in 2.13.0; this might show a way to approach this problem: by replacing simple recursion with iteration, either completely or at some inner levels.

Also note that it may ultimately be necessary to have lower-level constraints for streaming parser too, see: https://github.com/FasterXML/jackson-core/issues/637

Ideally it should be:

1. Possible to handle at least tens of thousands of levels of nesting (100k should be processable with 256M heap, say)
2. Have streaming level limits that -- by default -- block documents with more than limit we deem safe (less than 100k -- perhaps 10k or something, to be determined).

This issue is specifically about (1) as (2) is about `jackson-core`.

--- end body ---

comments :
--- start comments ---

--- end comments ---