Description
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- FasterXML / jackson-databind2.0.0 – 2.6.7.3
- oracle / clusterware12.1.0.2.0 – 12.1.0.2.0
- oracle / communications_instant_messaging_server10.0.1.2.0 – 10.0.1.2.0
- oracle / global_lifecycle_management_opatch11.2.0.3.23
- oracle / retail_customer_management_and_segmentation_foundation17.0 – 17.0
- oracle / utilities_advanced_spatial_and_operational_analytics2.7.0.1 – 2.7.0.1
- RedHat / openshift_container_platform4.1 – 4.1
- RedHat / openshift_container_platform3.11 – 3.11
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:1822
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:1823
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2804
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2858
- MAILING_LISThttps://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3002
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3140
- MAILING_LISThttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3149
- MAILING_LISThttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3892
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:4037
- MISChttps://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2020.html
- VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2020.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- CONFIRMhttps://nvd.nist.gov/vuln/detail/CVE-2017-7525
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:0782
- MISChttps://github.com/FasterXML/jackson-databind/issues/2032
Updated 21m ago · 8 sources