CVE-2019-17531

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

CVSS breakdown

Affected products

• Debian / debian_linux8.0 – 8.0
• FasterXML / jackson-databind2.0.0 – 2.6.7.3
• NetApp / OnCommand Workflow Automation
• NetApp / steelstore_cloud_integrated_storage
• oracle / banking_platform2.6.0 – 2.6.0
• oracle / banking_platform2.6.1 – 2.6.1
• oracle / banking_platform2.6.2 – 2.6.2
• oracle / banking_platform2.7.0 – 2.7.0
• oracle / banking_platform2.9.0 – 2.9.0
• oracle / banking_platform2.7.1 – 2.7.1
• oracle / banking_platform2.4.0 – 2.4.0
• oracle / banking_platform2.4.1 – 2.4.1
• oracle / banking_platform2.5.0 – 2.5.0
• oracle / communications_billing_and_revenue_management7.5.0.23.0 – 7.5.0.23.0
• oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_calendar_server8.0.0.2.0 – 8.0.0.2.0
• oracle / communications_calendar_server8.0.0.3.0 – 8.0.0.3.0
• oracle / communications_cloud_native_core_network_slice_selection_function1.2.1 – 1.2.1
• oracle / communications_evolved_communications_application_server7.1 – 7.1
• oracle / global_lifecycle_management_nextgen_oui_framework12.2.1.3.0 – 12.2.1.3.0
• oracle / global_lifecycle_management_nextgen_oui_framework12.2.1.4.0 – 12.2.1.4.0
• oracle / global_lifecycle_management_nextgen_oui_framework13.9.4.2.2 – 13.9.4.2.2
• oracle / goldengate_application_adapters19.1.0.0.0 – 19.1.0.0.0
• oracle / jd_edwards_enterpriseone_orchestrator9.2 – 9.2
• oracle / jd_edwards_enterpriseone_tools9.2 – 9.2
• oracle / primavera_gateway17.7 – 17.12.6
• oracle / primavera_gateway16.1 – 16.1
• oracle / primavera_gateway16.2 – 16.2
• oracle / primavera_gateway19.12.0 – 19.12.0
• oracle / retail_merchandising_system15.0.3 – 15.0.3
• oracle / retail_merchandising_system16.0.2 – 16.0.2
• oracle / retail_merchandising_system16.0.3 – 16.0.3
• oracle / retail_sales_audit14.1 – 14.1
• oracle / siebel_engineering_-_installer_&_deployment2.20.5
• oracle / trace_file_analyzer12.2.0.1 – 12.2.0.1
• oracle / trace_file_analyzer18c – 18c
• oracle / trace_file_analyzer19c – 19c
• oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
• oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0
• oracle / webcenter_sites12.2.1.3.0 – 12.2.1.3.0
• oracle / webcenter_sites12.2.1.4.0 – 12.2.1.4.0
• oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
• oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
• RedHat / jboss_enterprise_application_platform7.3 – 7.3
• RedHat / jboss_enterprise_application_platform7.2 – 7.2

References

• MAILING_LISThttps://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:4192
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2019/12/msg00013.html
• MAILING_LISThttps://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0164
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0159
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0160
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0161
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2020:0445
• MISChttps://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2020.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2020.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2020.html
• MISChttps://github.com/FasterXML/jackson-databind/issues/2498
• MISChttps://security.netapp.com/advisory/ntap-20191024-0005/
• MAILING_LISThttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
• MAILING_LISThttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html