Skip to content
Fencer Intel
medium 6.5

GHSA-q95j-488q-5q3p json

Apiman Manager API affected by Jackson denial of service vulnerability

published 3y ago modified 3y ago

cvss
6.5
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

Due to a vulnerability in `jackson-databind <= 2.12.6.0`, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.

This does **not** affect the Apiman Gateway.

### Patches

Upgrade to Apiman 3.0.0.Final or later.

If you are using an older version of Apiman and need to remain on that version, contact your Apiman [support provider](https://www.apiman.io/support.html) for advice/long-term support.

### Workarounds

If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.

### References

* Apiman maintainer and security contact: marc@blackparrotlabs.io * https://nvd.nist.gov/vuln/detail/CVE-2020-36518 * https://github.com/FasterXML/jackson-databind/issues/2816

Patch / fix

  • maven io.apiman:apiman-manager-api-impl 3.0.0.Final

Is GHSA-q95j-488q-5q3p in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.apiman:apiman-manager-api-impl
<3.0.0.Final
3.0.0.Final

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.