NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

Apiman Manager API affected by Jackson denial of service vulnerabilityGHSA-q95j-488q-5q3p

MEDIUM

GHSA-q95j-488q-5q3p is a medium-severity (CVSS 6.5) vulnerability in io.apiman:apiman-manager-api-impl. A fix is available for io.apiman:apiman-manager-api-impl — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Jan 9, 2023 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
☕io.apiman:apiman-manager-api-impl

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Due to a vulnerability in jackson-databind <= 2.12.6.0, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.

This does not affect the Apiman Gateway.

Patches

Upgrade to Apiman 3.0.0.Final or later.

If you are using an older version of Apiman and need to remain on that version, contact your Apiman support provider for advice/long-term support.

Workarounds

If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.

References

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenio.apiman:apiman-manager-api-implall versions3.0.0.Finalio.apiman:apiman-manager-api-impl:3.0.0.Final

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.apiman:apiman-manager-api-impl, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update io.apiman:apiman-manager-api-impl to 3.0.0.Final or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q95j-488q-5q3p is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Impact Due to a vulnerability in `jackson-databind <= 2.12.6.0`, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API. This does **not** affect the Apiman Gateway. ### Patches Upgrade to Apiman 3.0.0.Final or later. If you are using an older version of Apiman and need to remain on that version, contact your Apiman [support provider](https://www.apiman.io/support.html) for advice/long-term support. ### Workarounds If all users of the Apiman Manager are trusted then you may assess this is low ri
O3 Security · Impact-Aware SCA

Is GHSA-q95j-488q-5q3p in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Apiman Manager API affected by Jackson denial of…