WS-2018-0125 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

WS-2018-0125 - Medium Severity Vulnerability

Vulnerable Library - jackson-core-2.6.3.jar

Core Jackson abstractions, basic JSON streaming API implementation

path: /root/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.6.3/jackson-core-2.6.3.jar

Library home page: https://github.com/FasterXML/jackson-core

Dependency Hierarchy:

• spring-boot-starter-actuator-1.3.0.RELEASE.jar (Root Library)
  • spring-boot-actuator-1.3.0.RELEASE.jar
    • jackson-databind-2.6.3.jar
      • ❌ jackson-core-2.6.3.jar (Vulnerable Library)

Vulnerability Details

OutOfMemoryError when writing BigDecimal In Jackson Core before version 2.7.6.
When enabled the WRITE_BIGDECIMAL_AS_PLAIN setting, Jackson will attempt to write out the whole number, no matter how large the exponent.

Publish Date: 2018-06-24

URL: WS-2018-0125

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: FasterXML/jackson-core@9664297

Release Date: 2016-08-25

Fix Resolution: Replace or update the following files: GeneratorBase.java, WriterBasedJsonGenerator.java, TestJsonGeneratorFeatures.java, UTF8JsonGenerator.java, VERSION

---

Step up your Open Source Security Game with WhiteSource here