Red Hat Security Advisory: OpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: exfiltration/XXE in some JDK classes jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. jackson-databind: default typing mishandling leading to remote code execution
cpe:/a:redhat:openshift:4.1::el7