CVE-2022-42004 in WebCenter Portal

Summary

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Reservation

10/02/2022

Disclosure

10/02/2022

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
242703	Oracle WebCenter Portal Security denial of service	404	Not defined	Official fix	CVE-2022-42004
234959	Oracle AutoVue Security denial of service	404	Not defined	Official fix	CVE-2022-42004
226348	Oracle Communications Unified Assurance Core denial of service	404	Not defined	Official fix	CVE-2022-42004
210080	FasterXML jackson-databind Array BeanDeserializer._deserializeFromArray resource consumption	400	Not defined	Official fix	CVE-2022-42004

Sources

• MITRE
• NVD
• CVE Details