Bug#983664: jackson-dataformat-cbor: CVE-2020-28491

[Salvatore Bonaccorso]

Source: jackson-dataformat-cbor
Version: 2.7.8-3
Severity: important
Tags: security upstream
Forwarded: https://github.com/FasterXML/jackson-dataformats-binary/issues/186
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for jackson-dataformat-cbor.

CVE-2020-28491[0]:
| This affects the package com.fasterxml.jackson.dataformat:jackson-
| dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before
| 2.12.1. Unchecked allocation of byte buffer can cause a
| java.lang.OutOfMemoryError exception.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-28491
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28491
[1] https://github.com/FasterXML/jackson-dataformats-binary/issues/186
[2] https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
[2] https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329

Regards,
Salvatore