CVE-2019-14893: fallo de gravedad alta en Red Hat jackson-databind
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear jackson-databind+ Monitorear com.fasterxml.jackson.core:jackson-databind
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 4.1%
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Red Hat · jackson-databindCVEs relacionadas — Red Hat jackson-databind
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://access.redhat.com/errata/RHSA-2020:0729https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893https://github.com/FasterXML/jackson-databind/issues/2469https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20200327-0006/https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.html