USN-4741-1: Jackson vulnerabilities

Publication date

18 February 2021

Overview

Jackson could be made to crash if it opened a specially crafted file.

Releases

16.04 LTS

Packages

It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to execute
arbitrary code.

In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
16.04 xenial	libjackson-json-java – 1.9.2-7ubuntu0.2

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro