CVE-2020-36518 - Denial of Service (DoS)

Abstract

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

The jackson-databind package is vulnerable to a Denial of Service (DoS) attack. The deserialize() method in the UntypedObjectDeserializer and UntypedObjectDeserializer$Vanilla classes fails to restrict recursion when deserializing nested untyped or generic objects. A remote attacker who can supply data to be deserialized by an affected application can exploit this vulnerability to cause the JVM to consume all available memory, resulting in a StackOverflow exception and ultimately a DoS condition.

The Oxygen products incorporate jackson-databind as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2020-36518

Severity: High

CVSS Score: 7.5

The jackson-databind third-party library used by Oxygen XML products is an affected version mentioned in CVE-2020-36518 vulnerability description.

Starting with Oxygen Web Author v24.1.1 jackson-databind library was updated to a non-vulnerable version.

Starting with Oxygen Content Fusion v4.1 build 2022040914 jackson-databind library was updated to a non-vulnerable version.