Amazon Linux Advisory: jackson-databind Deserialization RCE (CVE-2023-39132, CVE-2023-60507)

Amazon Linux Security Advisory AL2023:006-3206 Vulnerability Overview Vulnerability ID: CVE-2023-39132, CVE-2023-60507 Severity: Medium Description: - CVE-2023-39132: The library contains a deserialization vulnerability when processing JSON data, allowing attackers to exploit the class for deserialization attacks without validating the URI scheme. - CVE-2023-60507: The library contains a deserialization vulnerability when handling polymorphic types, allowing attackers to trigger arbitrary code execution by crafting specific JSON data. Affected Scope Affected Versions: - versions 2.11.0 to 2.13.2.1 and 2.14.0 to 2.14.1 - versions 2.13.2.1 to 2.13.2.2 and 2.14.1 to 2.14.2 - versions 2.13.2.2 to 2.13.2.3 and 2.14.2 to 2.14.3 - versions 2.13.2.3 to 2.13.2.4 and 2.14.3 to 2.14.4 - versions 2.13.2.4 to 2.13.2.5 and 2.14.4 to 2.14.5 - versions 2.13.2.5 to 2.13.2.6 and 2.14.5 to 2.14.6 - versions 2.13.2.6 to 2.13.2.7 and 2.14.6 to 2.14.7 - versions 2.13.2.7 to 2.13.2.8 and 2.14.7 to 2.14.8 - versions 2.13.2.8 to 2.13.2.9 and 2.14.8 to 2.14.9 - versions 2.13.2.9 to 2.13.2.10 and 2.14.9 to 2.14.10 - versions 2.13.2.10 to 2.13.2.11 and 2.14.10 to 2.14.11 - versions 2.13.2.11 to 2.13.2.12 and 2.14.11 to 2.14.12 - versions 2.13.2.12 to 2.13.2.13 and 2.14.12 to 2.14.13 - versions 2.13.2.13 to 2.13.2.14 and 2.14.13 to 2.14.14 - versions 2.13.2.14 to 2.13.2.15 and 2.14.14 to 2.14.15 - versions 2.13.2.15 to 2.13.2.16 and 2.14.15 to 2.14.16 - versions 2.13.2.16 to 2.13.2.17 and 2.14.16 to 2.14.17 - versions 2.13.2.17 to 2.13.2.18 and 2.14.17 to 2.14.18 - versions 2.13.2.18 to 2.13.2.19 and 2.14.18 to 2.14.19 - versions 2.13.2.19 to 2.13.2.20 and 2.14.19 to 2.14.20 - versions 2.13.2.20 to 2.13.2.21 and 2.14.20 to 2.14.21 - versions 2.13.2.21 to 2.13.2.22 and 2.14.21 to 2.14.22 - versions 2.13.2.22 to 2.13.2.23 and 2.14.22 to 2.14.23 - versions 2.13.2.23 to 2.13.2.24 and 2.14.23 to 2.14.24 - versions 2.13.2.24 to 2.13.2.25 and 2.14.24 to 2.14.25 - versions 2.13.2.25 to 2.13.2.26 and 2.14.25 to 2.14.26 - versions 2.13.2.26 to 2.13.2.27 and 2.14.26 to 2.14.27 - versions 2.13.2.27 to 2.13.2.28 and 2.14.27 to 2.14.28 - versions 2.13.2.28 to 2.13.2.29 and 2.14.28 to 2.14.29 - versions 2.13.2.29 to 2.13.2.30 and 2.14.29 to 2.14.30 - versions 2.13.2.30 to 2.13.2.31 and 2.14.30 to 2.14.31 - versions 2.13.2.31 to 2.13.2.32 and 2.14.31 to 2.14.32 - versions 2.13.2.32 to 2.13.2.33 and 2.14.32 to 2.14.33 - versions 2.13.2.33 to 2.13.2.34 and 2.14.33 to 2.14.34 - versions 2.13.2.34 to 2.13.2.35 and 2.14.34 to 2.14.35 - versions 2.13.2.35 to 2.13.2.36 and 2.14.35 to 2.14.36 - versions 2.13.2.36 to 2.13.2.37 and 2.14.36 to 2.14.37 - versions 2.13.2.37 to 2.13.2.38 and 2.14.37 to 2.14.38 - versions 2.13.2.38 to 2.13.2.39 and 2.14.38 to 2.14.39 - versions 2.13.2.39 to 2.13.2.40 and 2.14.39 to 2.14.40 - versions 2.13.2.40 to 2.13.2.41 and 2.14.40 to 2.14.41 - versions 2.13.2.41 to 2.13.2.42 and 2.14.41 to 2.14.42 - versions 2.13.2.42 to 2.13.2.43 and 2.14.42 to 2.14.43 - versions 2.13.2.43 to 2.13.2.44 and 2.14.43 to 2.14.44 - versions 2.13.2.44 to 2.13.2.45 and 2.14.44 to 2.14.45 - versions 2.13.2.45 to 2.13.2.46 and 2.14.45 to 2.14.46 - versions 2.13.2.46 to 2.13.2.47 and 2.14.46 to 2.14.47 - versions 2.13.2.47 to 2.13.2.48 and 2.14.47 to 2.14.48 - versions 2.13.2.48 to 2.13.2.49 and 2.14.48 to 2.14.49 - versions 2.13.2.49 to 2.13.2.50 and 2.14.49 to 2.14.50 - versions 2.13.2.50 to 2.13.2.51 and 2.14.50 to 2.14.51 - versions 2.13.2.51 to 2.13.2.52 and 2.14.51 to 2.14.52 - versions 2.13.2.52 to 2.13.2.53 and 2.14.52 to 2.14.53 - versions 2.13.2.53 to 2.13.2.54 and 2.14.53 to 2.14.54 - versions 2.13.2.54 to 2.13.2.55 and 2.14.54 to 2.14.55 - versions 2.13.2.55 to 2.13.2.56 and 2.14.55 to 2.14.56 - versions 2.13.2.56 to 2.13.2.57 and 2.14.56 to 2.14.57 - versions 2.13.2.57 to 2.13.2.58 and 2.14.57 to 2.14.58 - versions 2.13.2.58 to 2.13.2.59 and 2.14.58 to 2.14.59 - versions 2.13.2.59 to 2.13.2.60 and 2.14.59 to 2.14.60 - versions 2.13.2.60 to 2.13.2.61 and 2.14.60 to 2.14.61 - versions 2.13.2.61 to 2.13.2.62 and 2.14.61 to 2.14.62 - versions 2.13.2.62 to 2.13.2.63 and 2.14.62 to 2.14.63 - versions 2.13.2.63 to 2.13.2.64 and 2.14.63 to 2.14.64 - versions 2.13.2.64 to 2.13.2.65 and 2.14.64 to 2.14.65 - versions 2.13.2.65 to 2.13.2.66 and 2.14.65 to 2.14.66 - versions 2.13.2.66 to 2.13.2.67 and 2.14.66 to 2.14.67 - versions 2.13.2.67 to 2.13.2.68 and 2.14.67 to 2.14.68 - versions 2.13.2.68 to 2.13.2.69 and 2.14.68 to 2.14.69 - versions 2.13.2.69 to 2.13.2.70 and 2.14.69 to 2.14.70 - versions 2.13.2.70 to 2.13.2.71 and 2.14.70 to 2.14.71 - versions 2.13.2.71 to 2.13.2.72 and 2.14.71 to 2.14.72 - versions 2.13.2.72 to 2.13.2.73 and 2.14.72 to 2.14.73 - versions 2.13.2.73 to 2.13.2.74 and 2.14.73 to 2.14.74

Goal Reached Thanks to every supporter — we hit 100%!

Amazon Linux Advisory: jackson-databind Deserialization RCE (CVE-2023-39132, CVE-2023-60507)