CVE-2019-16942

CRITICAL9.8Insecure deserialization

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

Debian / debian_linux8.0 – 8.0
Debian / debian_linux9.0 – 9.0
Debian / debian_linux10.0 – 10.0
FasterXML / jackson-databind2.0.0 – 2.6.7.3
fedoraproject / fedora31 – 31
fedoraproject / fedora30 – 30
NetApp / active_iq_unified_manager7.3 –
NetApp / active_iq_unified_manager9.5 –
NetApp / active_iq_unified_manager7.3 –
NetApp / oncommand_api_services
NetApp / OnCommand Workflow Automation
NetApp / service_level_manager
NetApp / steelstore_cloud_integrated_storage
oracle / banking_platform2.9.0 – 2.9.0
oracle / banking_platform2.4.0 – 2.4.0
oracle / banking_platform2.7.0 – 2.7.0
oracle / banking_platform2.7.1 – 2.7.1
oracle / banking_platform2.4.1 – 2.4.1
oracle / banking_platform2.5.0 – 2.5.0
oracle / banking_platform2.6.0 – 2.6.0
oracle / banking_platform2.6.1 – 2.6.1
oracle / banking_platform2.6.2 – 2.6.2
oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
oracle / communications_billing_and_revenue_management7.5.0.23.0 – 7.5.0.23.0
oracle / communications_calendar_server8.0.0.2.0 – 8.0.0.2.0
oracle / communications_calendar_server8.0.0.3.0 – 8.0.0.3.0
oracle / communications_cloud_native_core_network_slice_selection_function1.2.1 – 1.2.1
oracle / communications_evolved_communications_application_server7.1 – 7.1
oracle / database_server18c – 18c
oracle / database_server19c – 19c
oracle / database_server12.2.0.1 – 12.2.0.1
oracle / global_lifecycle_management_nextgen_oui_framework13.9.4.2.2 – 13.9.4.2.2
oracle / global_lifecycle_management_nextgen_oui_framework12.2.1.3.0 – 12.2.1.3.0
oracle / global_lifecycle_management_nextgen_oui_framework12.2.1.4.0 – 12.2.1.4.0
oracle / goldengate_application_adapters19.1.0.0.0 – 19.1.0.0.0
oracle / jd_edwards_enterpriseone_orchestrator9.2 – 9.2
oracle / jd_edwards_enterpriseone_tools9.2 – 9.2
oracle / primavera_gateway19.12.0 – 19.12.0
oracle / primavera_gateway17.12.0 – 17.12.6
oracle / primavera_unifier16.2 – 16.2
oracle / primavera_unifier19.12 – 19.12
oracle / primavera_unifier17.7 – 17.12
oracle / primavera_unifier16.1 – 16.1
oracle / primavera_unifier18.8 – 18.8
oracle / retail_merchandising_system16.0.2 – 16.0.2
oracle / retail_merchandising_system16.0.3 – 16.0.3
oracle / retail_merchandising_system15.0.3 – 15.0.3
oracle / retail_sales_audit14.1 – 14.1
oracle / siebel_engineering_-_installer_&_deployment2.20.5
oracle / Siebel UI Framework20.6 – 20.6
oracle / Siebel UI Framework20.5
oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0
oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
oracle / webcenter_sites12.2.1.3.0 – 12.2.1.3.0
oracle / webcenter_sites12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
RedHat / jboss_enterprise_application_platform7.3 – 7.3
RedHat / jboss_enterprise_application_platform7.2.0 – 7.2.0

References

Updated 22m ago · 8 sources