jackson-databind (SUSE:Manager Server 4.1) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Server 4.1 package jackson-databind, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2020-25649 — CVSS 7.5 (high): A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to…
• CVE-2020-28491 — CVSS 7.5 (high): This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before…
• CVE-2020-36518 — CVSS 7.5 (high): jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
• CVE-2022-42003 — CVSS 7.5 (high): In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in…
• CVE-2022-42004 — CVSS 7.5 (high): In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFrom…