jackson-coreutils vulnerabilities

A vulnerability in java-json-tools jackson-coreutils 2.0 affects the TreePointer.tokensFromInput function in src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java in the JSON Pointer parser component. Manipulation results in resource allocation. The attack can be executed remotely, and the exploit has been released publicly. The project has not responded to the issue report.

A vulnerability in java-json-tools jackson-coreutils 2.0 affects the BigDecimal.toPlainString function in src/main/java/com/github/fge/jackson/JacksonUtils.java. Manipulation results in resource consumption. The attack may be initiated remotely, and the exploit has been made public. The project has not responded to the issue report.

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.