First published: Sun Sep 15 2019(Updated: )
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. It is related to `com.zaxxer.hikari.HikariConfig`.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/eap7-apache-cxf | <0:3.2.11-1.redhat_00001.1.el6ea | 0:3.2.11-1.redhat_00001.1.el6ea |
redhat/eap7-glassfish-jsf | <0:2.3.5-6.SP3_redhat_00004.1.el6ea | 0:2.3.5-6.SP3_redhat_00004.1.el6ea |
redhat/eap7-hal-console | <0:3.0.19-1.Final_redhat_00001.1.el6ea | 0:3.0.19-1.Final_redhat_00001.1.el6ea |
redhat/eap7-hibernate | <0:5.3.14-1.Final_redhat_00001.1.el6ea | 0:5.3.14-1.Final_redhat_00001.1.el6ea |
redhat/eap7-hibernate-validator | <0:6.0.18-1.Final_redhat_00001.1.el6ea | 0:6.0.18-1.Final_redhat_00001.1.el6ea |
redhat/eap7-jackson-annotations | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-core | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-databind | <0:2.9.10.1-1.redhat_00001.1.el6ea | 0:2.9.10.1-1.redhat_00001.1.el6ea |
redhat/eap7-jackson-dataformats-binary | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-dataformats-text | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-jaxrs-providers | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-modules-base | <0:2.9.10-2.redhat_00003.1.el6ea | 0:2.9.10-2.redhat_00003.1.el6ea |
redhat/eap7-jackson-modules-java8 | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jberet | <0:1.3.5-1.Final_redhat_00001.1.el6ea | 0:1.3.5-1.Final_redhat_00001.1.el6ea |
redhat/eap7-jboss-ejb-client | <0:4.0.27-1.Final_redhat_00001.1.el6ea | 0:4.0.27-1.Final_redhat_00001.1.el6ea |
redhat/eap7-jboss-server-migration | <0:1.3.1-7.Final_redhat_00007.1.el6ea | 0:1.3.1-7.Final_redhat_00007.1.el6ea |
redhat/eap7-jboss-xnio-base | <0:3.7.6-3.SP2_redhat_00001.1.el6ea | 0:3.7.6-3.SP2_redhat_00001.1.el6ea |
redhat/eap7-netty | <0:4.1.42-1.Final_redhat_00001.1.el6ea | 0:4.1.42-1.Final_redhat_00001.1.el6ea |
redhat/eap7-picketlink-bindings | <0:2.5.5-21.SP12_redhat_00010.1.el6ea | 0:2.5.5-21.SP12_redhat_00010.1.el6ea |
redhat/eap7-undertow | <0:2.0.28-2.SP1_redhat_00001.1.el6ea | 0:2.0.28-2.SP1_redhat_00001.1.el6ea |
redhat/eap7-undertow-jastow | <0:2.0.8-1.Final_redhat_00001.1.el6ea | 0:2.0.8-1.Final_redhat_00001.1.el6ea |
redhat/eap7-weld-core | <0:3.0.6-3.Final_redhat_00003.1.el6ea | 0:3.0.6-3.Final_redhat_00003.1.el6ea |
redhat/eap7-wildfly | <0:7.2.6-5.GA_redhat_00001.1.el6ea | 0:7.2.6-5.GA_redhat_00001.1.el6ea |
redhat/eap7-wildfly-http-client | <0:1.0.18-2.Final_redhat_00001.1.el6ea | 0:1.0.18-2.Final_redhat_00001.1.el6ea |
redhat/eap7-wildfly-transaction-client | <0:1.1.8-1.Final_redhat_00001.1.el6ea | 0:1.1.8-1.Final_redhat_00001.1.el6ea |
redhat/eap7-apache-cxf | <0:3.2.11-1.redhat_00001.1.el7ea | 0:3.2.11-1.redhat_00001.1.el7ea |
redhat/eap7-glassfish-jsf | <0:2.3.5-6.SP3_redhat_00004.1.el7ea | 0:2.3.5-6.SP3_redhat_00004.1.el7ea |
redhat/eap7-hal-console | <0:3.0.19-1.Final_redhat_00001.1.el7ea | 0:3.0.19-1.Final_redhat_00001.1.el7ea |
redhat/eap7-hibernate | <0:5.3.14-1.Final_redhat_00001.1.el7ea | 0:5.3.14-1.Final_redhat_00001.1.el7ea |
redhat/eap7-hibernate-validator | <0:6.0.18-1.Final_redhat_00001.1.el7ea | 0:6.0.18-1.Final_redhat_00001.1.el7ea |
redhat/eap7-jackson-annotations | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-core | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-databind | <0:2.9.10.1-1.redhat_00001.1.el7ea | 0:2.9.10.1-1.redhat_00001.1.el7ea |
redhat/eap7-jackson-dataformats-binary | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-dataformats-text | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-jaxrs-providers | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-modules-base | <0:2.9.10-2.redhat_00003.1.el7ea | 0:2.9.10-2.redhat_00003.1.el7ea |
redhat/eap7-jackson-modules-java8 | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jberet | <0:1.3.5-1.Final_redhat_00001.1.el7ea | 0:1.3.5-1.Final_redhat_00001.1.el7ea |
redhat/eap7-jboss-ejb-client | <0:4.0.27-1.Final_redhat_00001.1.el7ea | 0:4.0.27-1.Final_redhat_00001.1.el7ea |
redhat/eap7-jboss-server-migration | <0:1.3.1-7.Final_redhat_00007.1.el7ea | 0:1.3.1-7.Final_redhat_00007.1.el7ea |
redhat/eap7-jboss-xnio-base | <0:3.7.6-3.SP2_redhat_00001.1.el7ea | 0:3.7.6-3.SP2_redhat_00001.1.el7ea |
redhat/eap7-netty | <0:4.1.42-1.Final_redhat_00001.1.el7ea | 0:4.1.42-1.Final_redhat_00001.1.el7ea |
redhat/eap7-picketlink-bindings | <0:2.5.5-21.SP12_redhat_00010.1.el7ea | 0:2.5.5-21.SP12_redhat_00010.1.el7ea |
redhat/eap7-undertow | <0:2.0.28-2.SP1_redhat_00001.1.el7ea | 0:2.0.28-2.SP1_redhat_00001.1.el7ea |
redhat/eap7-undertow-jastow | <0:2.0.8-1.Final_redhat_00001.1.el7ea | 0:2.0.8-1.Final_redhat_00001.1.el7ea |
redhat/eap7-weld-core | <0:3.0.6-3.Final_redhat_00003.1.el7ea | 0:3.0.6-3.Final_redhat_00003.1.el7ea |
redhat/eap7-wildfly | <0:7.2.6-5.GA_redhat_00001.1.el7ea | 0:7.2.6-5.GA_redhat_00001.1.el7ea |
redhat/eap7-wildfly-http-client | <0:1.0.18-2.Final_redhat_00001.1.el7ea | 0:1.0.18-2.Final_redhat_00001.1.el7ea |
redhat/eap7-wildfly-transaction-client | <0:1.1.8-1.Final_redhat_00001.1.el7ea | 0:1.1.8-1.Final_redhat_00001.1.el7ea |
redhat/eap7-apache-cxf | <0:3.2.11-1.redhat_00001.1.el8ea | 0:3.2.11-1.redhat_00001.1.el8ea |
redhat/eap7-glassfish-jsf | <0:2.3.5-6.SP3_redhat_00004.1.el8ea | 0:2.3.5-6.SP3_redhat_00004.1.el8ea |
redhat/eap7-hal-console | <0:3.0.19-1.Final_redhat_00001.1.el8ea | 0:3.0.19-1.Final_redhat_00001.1.el8ea |
redhat/eap7-hibernate | <0:5.3.14-1.Final_redhat_00001.1.el8ea | 0:5.3.14-1.Final_redhat_00001.1.el8ea |
redhat/eap7-hibernate-validator | <0:6.0.18-1.Final_redhat_00001.1.el8ea | 0:6.0.18-1.Final_redhat_00001.1.el8ea |
redhat/eap7-jackson-annotations | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-core | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-databind | <0:2.9.10.1-1.redhat_00001.1.el8ea | 0:2.9.10.1-1.redhat_00001.1.el8ea |
redhat/eap7-jackson-dataformats-binary | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-dataformats-text | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-jaxrs-providers | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-modules-base | <0:2.9.10-2.redhat_00003.1.el8ea | 0:2.9.10-2.redhat_00003.1.el8ea |
redhat/eap7-jackson-modules-java8 | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jberet | <0:1.3.5-1.Final_redhat_00001.1.el8ea | 0:1.3.5-1.Final_redhat_00001.1.el8ea |
redhat/eap7-jboss-ejb-client | <0:4.0.27-1.Final_redhat_00001.1.el8ea | 0:4.0.27-1.Final_redhat_00001.1.el8ea |
redhat/eap7-jboss-server-migration | <0:1.3.1-7.Final_redhat_00007.1.el8ea | 0:1.3.1-7.Final_redhat_00007.1.el8ea |
redhat/eap7-jboss-xnio-base | <0:3.7.6-3.SP2_redhat_00001.1.el8ea | 0:3.7.6-3.SP2_redhat_00001.1.el8ea |
redhat/eap7-netty | <0:4.1.42-1.Final_redhat_00001.1.el8ea | 0:4.1.42-1.Final_redhat_00001.1.el8ea |
redhat/eap7-picketlink-bindings | <0:2.5.5-21.SP12_redhat_00010.1.el8ea | 0:2.5.5-21.SP12_redhat_00010.1.el8ea |
redhat/eap7-undertow | <0:2.0.28-2.SP1_redhat_00001.1.el8ea | 0:2.0.28-2.SP1_redhat_00001.1.el8ea |
redhat/eap7-undertow-jastow | <0:2.0.8-1.Final_redhat_00001.1.el8ea | 0:2.0.8-1.Final_redhat_00001.1.el8ea |
redhat/eap7-weld-core | <0:3.0.6-3.Final_redhat_00003.1.el8ea | 0:3.0.6-3.Final_redhat_00003.1.el8ea |
redhat/eap7-wildfly | <0:7.2.6-5.GA_redhat_00001.1.el8ea | 0:7.2.6-5.GA_redhat_00001.1.el8ea |
redhat/eap7-wildfly-http-client | <0:1.0.18-2.Final_redhat_00001.1.el8ea | 0:1.0.18-2.Final_redhat_00001.1.el8ea |
redhat/eap7-wildfly-transaction-client | <0:1.1.8-1.Final_redhat_00001.1.el8ea | 0:1.1.8-1.Final_redhat_00001.1.el8ea |
debian/jackson-databind | 2.9.8-3+deb10u3 2.9.8-3+deb10u5 2.12.1-1+deb11u1 2.14.0-1 | |
redhat/jackson-databind | <2.9.10 | 2.9.10 |
maven/com.fasterxml.jackson.core:jackson-databind | <2.6.7.3 | 2.6.7.3 |
maven/com.fasterxml.jackson.core:jackson-databind | >=2.7.0<2.8.11.5 | 2.8.11.5 |
maven/com.fasterxml.jackson.core:jackson-databind | >=2.9.0<2.9.10 | 2.9.10 |
FasterXML jackson-databind | >=2.0.0<2.6.7.3 | |
FasterXML jackson-databind | >=2.7.0<2.8.11.5 | |
FasterXML jackson-databind | >=2.9.0<2.9.10 | |
NetApp OnCommand API Services | ||
NetApp OnCommand Workflow Automation | ||
Netapp Steelstore Cloud Integrated Storage | ||
Fedoraproject Fedora | =30 | |
Fedoraproject Fedora | =31 | |
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
All of | ||
Any of | ||
Redhat Jboss Enterprise Application Platform | =7.2 | |
Redhat Jboss Enterprise Application Platform | =7.3 | |
Any of | ||
Redhat Enterprise Linux | =6.0 | |
Redhat Enterprise Linux | =7.0 | |
Redhat Enterprise Linux | =8.0 | |
Oracle Banking Platform | =2.4.0 | |
Oracle Banking Platform | =2.4.1 | |
Oracle Banking Platform | =2.5.0 | |
Oracle Banking Platform | =2.6.0 | |
Oracle Banking Platform | =2.6.1 | |
Oracle Banking Platform | =2.7.0 | |
Oracle Banking Platform | =2.7.1 | |
Oracle Customer Management And Segmentation Foundation | =18.0 | |
Oracle Financial Services Analytical Applications Infrastructure | >=8.0.2<=8.0.8 | |
Oracle Global Lifecycle Management Opatch | <11.2.0.3.23 | |
Oracle Global Lifecycle Management Opatch | >=12.2.0.1.0<12.2.0.1.19 | |
Oracle Global Lifecycle Management Opatch | >=13.9.4.0.0<13.9.4.2.1 | |
Oracle Goldengate Application Adapters | =19.1.0.0.0 | |
Oracle Goldengate Stream Analytics | <19.1.0.0.1 | |
Oracle MySQL | >=5.7.0<=5.7.30 | |
Oracle MySQL | >=8.0.0<=8.0.20 | |
Oracle Primavera Gateway | =15.2 | |
Oracle Primavera Gateway | =15.2.18 | |
Oracle Primavera Gateway | =16.2 | |
Oracle Primavera Gateway | =16.2.11 | |
Oracle Primavera Gateway | =17.12 | |
Oracle Primavera Gateway | =17.12.6 | |
Oracle Primavera Gateway | =18.8.0 | |
Oracle Primavera Gateway | =18.8.8.1 | |
Oracle Primavera Unifier | >=17.7<=17.12 | |
Oracle Primavera Unifier | =16.1 | |
Oracle Primavera Unifier | =16.2 | |
Oracle Primavera Unifier | =18.8 | |
Oracle Primavera Unifier | =19.12 | |
Oracle Retail Customer Management and Segmentation Foundation | =17.0 | |
Oracle Retail Xstore Point of Service | =7.1 | |
Oracle Retail Xstore Point of Service | =15.0 | |
Oracle Retail Xstore Point of Service | =16.0 | |
Oracle Retail Xstore Point of Service | =17.0 | |
Oracle Retail Xstore Point of Service | =18.0 | |
Oracle WebLogic Server | =12.2.1.3.0 | |
Redhat Jboss Enterprise Application Platform | =7.2 | |
Redhat Jboss Enterprise Application Platform | =7.3 | |
Redhat Enterprise Linux | =6.0 | |
Redhat Enterprise Linux | =7.0 | |
Redhat Enterprise Linux | =8.0 | |
IBM RQM | <=6.0.6.1 | |
IBM RQM | <=6.0.6 | |
IBM ETM | <=7.0.0 | |
IBM RQM | <=6.0.2 | |
IBM EWM | <=7.0 | |
IBM CLM | <=6.0.6.1 | |
IBM CLM | <=6.0.6 | |
IBM ELM | <=7.0 | |
IBM CLM | <=6.0.2 | |
IBM RDNG | <=6.0.2 | |
IBM RDNG | <=6.0.6.1 | |
IBM RDNG | <=6.0.6 | |
IBM DOORS Next | <=7.0 |
This vulnerability relies on com.zaxxer.hikari.HikariConfig being present in the application's ClassPath. Hikari is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use com.zaxxer.hikari are not impacted by this vulnerability. A mitigation to this class of problem in jackson-databind is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)