Hacker GitHub

← All repos

FasterXML/jackson-databind

View on GitHub ↗ ★ 3,755 Java

General data-binding package for Jackson: works on streaming API (core) implementation(s)

11 mentions on Hacker News by 9 people: 3 stories, 8 comments · first 2018-05-02 · latest 2023-09-22

Mentions per year 11 mentions · busiest year 2019 (6)
20082026
AllStoriesComments NewestTopOldest
  1. …where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/FasterXML/jackson-databind/issues/3972 Basically the programmer (not the attacker) had to write code where an object…
    comment by nikanj · 2023-09-22 · in The Bogus CVE Problem
  2. jackson-databind maintainer responds to a similar occurrence few weeks ago: https://github.com/FasterXML/jackson-databind/issues/3972#is...
    comment by hathym · 2023-09-06 · in Now it's PostgreSQL's turn to have a bogus CVE
  3. ▲ 4
    Disputed Jackson-databind CVE Causing Disruption
    story by matth3wmf · 2023-06-28 · 2 comments
  4. ▲ 1
    Block two more gadget types (ibatis-sqlmap anteros-C CVE-2020-9547 CVE-2020-9548
    story by based2 · 2020-03-07 · 0 comments
  5. https://github.com/FasterXML/jackson-databind/issues/2410 Block one more gadget type (HikariCP, CVE-2019-14540) https://github.com/FasterXML/jackson-databind/issues/2478 Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 /…
    comment by based2 · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  6. …/@cowtowncoder/on-jackson-cves-dont-panic-... The most recent relates to blocking yet another gadget: https://github.com/FasterXML/jackson-databind/issues/2478 As another commenter mentions, this whole set of issues is only a problem if…
    comment by twic · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  7. This is one of the fixes: https://github.com/FasterXML/jackson-databind/commit/9593e16... It seems like it's a blacklist of types to not automatically de-serialize? If so, that's.... not good.
    comment by orf · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  8. …to do this with untrusted input and the method is deprecated in the latest versions of the library. https://github.com/FasterXML/jackson-databind/issues/2195 https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymo...
    comment by lol768 · 2019-10-06 · in Jackson-databind – remote code execution vulnerability
  9. ▲ 1
    Jackson-bind Block yet another gadget type (CVE-2019-12814)
    story by based2 · 2019-07-21 · 1 comment
  10. …message encoders and decoders for conversion between protobuf and bytebuf. You could also use https://github.com/FasterXML/jackson-databind but that would require a reasonable amount of custom code for the encoder and decoders
    comment by siddcoder · 2019-06-29 · in Building RPC layer in a distributed system using Netty – A tutorial
  11. …even the well-known and used ones are of very questionable quality[2]. [1]: https://serde.rs/ [2]: https://github.com/FasterXML/jackson-databind/pull/1423
    comment by tazjin · 2018-05-02 · in Rust in production at Figma