FasterXML jackson-databind before 18.104.22.168 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Fixed in 22.214.171.124 (newly released) and 2.9.5 (when it is released).
- Gentoo Security Padawan -
2.9.5 released 3/26/2018 with fix see:
@Demetris, fyi 2.8.11 branch is milestone/testing.
Package removed from the Portage tree.