You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by "Kapil Shewate (Jira)" <ji...@apache.org> on 2025/05/03 12:53:00 UTC
[jira] [Commented] (CASSANDRA-20617) BDSA-2022-4307 vulnerability is reported by BluckDuck scan in apache-cassandra/lib/jackson-core-2.13.2.jar Cassandra5.0.2
[ https://issues.apache.org/jira/browse/CASSANDRA-20617?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17949162#comment-17949162 ]
Kapil Shewate commented on CASSANDRA-20617:
-------------------------------------------
Can anyone confirm if Cassandra 5.0.2 is vulnerable to the above CVE.
> BDSA-2022-4307 vulnerability is reported by BluckDuck scan in apache-cassandra/lib/jackson-core-2.13.2.jar Cassandra5.0.2
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-20617
> URL: https://issues.apache.org/jira/browse/CASSANDRA-20617
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Kapil Shewate
> Priority: Normal
>
> FasterXML Jackson Core does not restrict the size of certain numeric types. A remote attacker able to supply specially crafted serialized data to an application that deserializes it, could cause excessive resource consumption resulting in a denial-of-service (DoS).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org