CVE-2019-14439: Infoleak
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Other sources
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.8-3+deb10u3Fixed in 2.9.8-3+deb10u5Fixed in 2.12.1-1+deb11u1Fixed in 2.14.0-1 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.3 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.6 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.9.2 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.10 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.4 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.6 - Upgrade
Upgrade
redhat/jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.3 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.9.9.2 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.8.11.4 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.7.9.6 - Upgrade
Upgrade
com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.6.7.3 - Configuration
Avoid enabling Default Typing (globally or for specific properties) on externally exposed JSON endpoints to prevent polymorphic deserialization abuse.
Jackson Databind (polymorphic typing) enableDefaultTyping() = do not enable - Configuration
Do not configure polymorphic typing using @JsonTypeInfo with `use` set to `id.CLASS` or `id.MINIMAL_CLASS` on data that can be influenced by an attacker.
Jackson Databind (polymorphic typing annotations) @JsonTypeInfo using id.CLASS / id.MINIMAL_CLASS = do not use id.CLASS or id.MINIMAL_CLASS - Compensating control
Ensure externally exposed JSON endpoints do not have Default Typing enabled (globally or per-property) when jackson-databind is used with the logback jar present on the classpath; remove/avoid the risky combination if possible.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-14439?
CVE-2019-14439 has a moderate severity rating due to potential security risks related to polymorphic typing in certain configurations of the Jackson-databind library.
How do I fix CVE-2019-14439?
To fix CVE-2019-14439, update jackson-databind to version 2.9.9.2, 2.8.11.4, 2.7.9.6, or 2.6.7.3 or higher.
What software is affected by CVE-2019-14439?
CVE-2019-14439 affects multiple versions of the FasterXML jackson-databind library across various applications, including those provided by Debian and IBM.
What types of attacks does CVE-2019-14439 enable?
CVE-2019-14439 allows attackers to exploit polymorphic typing issues, potentially leading to remote code execution on systems with vulnerable configurations.
Is it safe to use default typing in JSON endpoints after CVE-2019-14439?
Using default typing in JSON endpoints can be risky after CVE-2019-14439; it is advisable to avoid or limit its use unless the library is updated.