Bug 1212399 (CVE-2023-35116)

Summary: VUL-0: CVE-2023-35116: jackson-databind: Stack overflow error caused by serialization of Map or List with self references
Product: [Novell Products] SUSE Security Incidents Reporter: Cathy Hu <cathy.hu>
Component: IncidentsAssignee: Fridrich Strba <fstrba>
Status: RESOLVED WONTFIX QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: security-team
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/369531/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Cathy Hu 2023-06-15 07:18:48 UTC
CVE-2023-35116

An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a
denial of service or other unspecified impacts via crafted object that uses
cyclic dependencies.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-35116
https://www.cve.org/CVERecord?id=CVE-2023-35116
https://github.com/FasterXML/jackson-databind/issues/3972
Comment 1 Cathy Hu 2023-06-15 07:19:43 UTC
upstream could not reproduce it yet and there is no fix, just opening this bug for tracking
Comment 2 Cathy Hu 2023-06-19 07:23:57 UTC
closing, wontfix