Hacker GitHub

← All repos

FasterXML/jackson-databind

View on GitHub ↗ ★ 3,755 Java

General data-binding package for Jackson: works on streaming API (core) implementation(s)

11 mentions on Hacker News by 9 people: 3 stories, 8 comments · first 2018-05-02 · latest 2023-09-22

Mentions per year 11 mentions · busiest year 2019 (6)
20082026
AllStoriesComments NewestTopOldest
  1. …where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/FasterXML/jackson-databind/issues/3972 Basically the programmer (not the attacker) had to write code where an object…
    comment by nikanj · 2023-09-22 · in The Bogus CVE Problem
  2. jackson-databind maintainer responds to a similar occurrence few weeks ago: https://github.com/FasterXML/jackson-databind/issues/3972#is...
    comment by hathym · 2023-09-06 · in Now it's PostgreSQL's turn to have a bogus CVE
  3. https://github.com/FasterXML/jackson-databind/issues/2410 Block one more gadget type (HikariCP, CVE-2019-14540) https://github.com/FasterXML/jackson-databind/issues/2478 Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 /…
    comment by based2 · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  4. …/@cowtowncoder/on-jackson-cves-dont-panic-... The most recent relates to blocking yet another gadget: https://github.com/FasterXML/jackson-databind/issues/2478 As another commenter mentions, this whole set of issues is only a problem if…
    comment by twic · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  5. This is one of the fixes: https://github.com/FasterXML/jackson-databind/commit/9593e16... It seems like it's a blacklist of types to not automatically de-serialize? If so, that's.... not good.
    comment by orf · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  6. …to do this with untrusted input and the method is deprecated in the latest versions of the library. https://github.com/FasterXML/jackson-databind/issues/2195 https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymo...
    comment by lol768 · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  7. …message encoders and decoders for conversion between protobuf and bytebuf. You could also use https://github.com/FasterXML/jackson-databind but that would require a reasonable amount of custom code for the encoder and decoders
    comment by siddcoder · 2019-06-29 · in Building RPC layer in a distributed system using Netty – A tutorial
  8. …even the well-known and used ones are of very questionable quality[2]. [1]: https://serde.rs/ [2]: https://github.com/FasterXML/jackson-databind/pull/1423
    comment by tazjin · 2018-05-02 · in Rust in production at Figma