-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 15 Nov 2022 20:21:49 CET
Source: jackson-databind
Architecture: source
Version: 2.12.1-1+deb11u1
Distribution: bullseye-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Checksums-Sha1:
4d28c66afc01c0a8813ff3e8a5419e1cc8a80ba8 2722 jackson-databind_2.12.1-1+deb11u1.dsc
f6ea260696b7d41eb252b7ac71912e551cb05753 982580 jackson-databind_2.12.1.orig.tar.xz
5f54350cae517bd856137c4f0fae52396b802be1 10508 jackson-databind_2.12.1-1+deb11u1.debian.tar.xz
9ec8a2e494ddeb048a542d6daa504f784ade0d87 17640 jackson-databind_2.12.1-1+deb11u1_amd64.buildinfo
Checksums-Sha256:
a1642d4aaa945d1cdabb8663106b62dbb735abf7bce980a77956f8b8b1471033 2722 jackson-databind_2.12.1-1+deb11u1.dsc
ff150815861e70874eb185f0c8ab9c88e6dc1e92bc93ddde6ecb58468231481c 982580 jackson-databind_2.12.1.orig.tar.xz
70c5e9ce18f1aa52c21956bfe0b259be2130a8abe700e3e8e1951ac57d752ce0 10508 jackson-databind_2.12.1-1+deb11u1.debian.tar.xz
ab1b37ebe54754cf1679a2f607048850b4eeb99e902683419980bac2ce714196 17640 jackson-databind_2.12.1-1+deb11u1_amd64.buildinfo
Changes:
jackson-databind (2.12.1-1+deb11u1) bullseye-security; urgency=high
.
* Team upload.
* Fix CVE-2022-42003:
In FasterXML jackson-databind resource exhaustion can
occur because of a lack of a check in primitive value deserializers to
avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS
feature is enabled.
* Fix CVE-2022-42004:
In FasterXML jackson-databind resource exhaustion can occur because of a
lack of a check in BeanDeserializerBase.deserializeFromArray to prevent use of
deeply nested arrays. An application is vulnerable only with certain
customized choices for deserialization.
* Fix CVE-2020-36518:
Java StackOverflow exception and denial of service via a large depth of
nested objects.
Files:
51fc3dbcc90ad2469079dc36d64d06db 2722 java optional jackson-databind_2.12.1-1+deb11u1.dsc
b3c731f366e3abf6ff909768b4981441 982580 java optional jackson-databind_2.12.1.orig.tar.xz
9828a87ba936b78b526e594be21b046f 10508 java optional jackson-databind_2.12.1-1+deb11u1.debian.tar.xz
4e823079960706afc737a61225762fa2 17640 java optional jackson-databind_2.12.1-1+deb11u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmNz54dfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp YW4ub3JnAAoJENmtFLlRO1HkVowP/3GIXfwowU1hHCc3SLPkTXxiAv/hkbwZr+V3 u9LbwhoOqe5ANzst028p4WQ8MQ+eMOoHh6rM9tLnrqZt2MbTEOoW0a/1vr2D6J5m gYlUEjj+b1+Z9+3ya1oF27xwfoq1fLCru3o6UPYoVhV2r6JqAPB5wxWvTkHWcowa EcBgvdnq80ULlVfbkmG5vESxlUuGTr3NjRg+xlMIkiCozzkk8d4F7jzRzHhFzmX6 tFX/HwfmVJY68zg2kNjQxFqS3VYxKduX44Zipd3yGCoCNg9Jp6VxPaKTcVEvLsTa Y4WtzBrSY9a3S2brJ8wUX6H+ui1eqSKCxshv7iUvIcLEhvtMFsX8dmFa7/CIPn1o LJXN7P2v+729WIDGiAgu3b3h3uEEEkvEwHCDfTY9nrsfbO4+auTl/zBNtjqUHgCl Bz4vDyb7fVc9P1cx3kHYCxUM8eMUPrNppXhg7XWeEEw/g9o2JhtB6SJItuTFxRXf iyVoENS1SKHIaUzk3/ATbI5n+a1SNlPCyr8Hu6E0YwfA0XC/fKEG4Ak8H+lYfiwR lWDEd+Pa7zQ/75GQyrCA/x2L+TK41yr4kFVsRw57THy757hrrAlprgL2R0R9Xw2J 4EUsddcJJspdKNq3Fqger7yVvbDv+iQflOxbIeq9wjrcD4ZbwIvF9Vdp1HZpPP9y
k5CKhbo1
=WK+r
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)