First published: Tue Sep 17 2019(Updated: )
A flaw was found in jackson-databind before 2.9.10. New serialization gadgets were found regarding a class of the ehcache package which may help in exploiting deserialization issues. Upstream issue: <a href="https://github.com/FasterXML/jackson-databind/issues/2460">https://github.com/FasterXML/jackson-databind/issues/2460</a> Upstream patch: <a href="https://github.com/FasterXML/jackson-databind/commit/191a4cdf87b56d2ddddb77edd895ee756b7f75eb">https://github.com/FasterXML/jackson-databind/commit/191a4cdf87b56d2ddddb77edd895ee756b7f75eb</a> References: <a href="https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062">https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062</a>
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
maven/com.fasterxml.jackson.core:jackson-databind | <2.8.11.5 | 2.8.11.5 |
maven/com.fasterxml.jackson.core:jackson-databind | >=2.9.0<2.9.10 | 2.9.10 |
redhat/eap7-apache-cxf | <0:3.2.11-1.redhat_00001.1.el6ea | 0:3.2.11-1.redhat_00001.1.el6ea |
redhat/eap7-glassfish-jsf | <0:2.3.5-6.SP3_redhat_00004.1.el6ea | 0:2.3.5-6.SP3_redhat_00004.1.el6ea |
redhat/eap7-hal-console | <0:3.0.19-1.Final_redhat_00001.1.el6ea | 0:3.0.19-1.Final_redhat_00001.1.el6ea |
redhat/eap7-hibernate | <0:5.3.14-1.Final_redhat_00001.1.el6ea | 0:5.3.14-1.Final_redhat_00001.1.el6ea |
redhat/eap7-hibernate-validator | <0:6.0.18-1.Final_redhat_00001.1.el6ea | 0:6.0.18-1.Final_redhat_00001.1.el6ea |
redhat/eap7-jackson-annotations | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-core | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-databind | <0:2.9.10.1-1.redhat_00001.1.el6ea | 0:2.9.10.1-1.redhat_00001.1.el6ea |
redhat/eap7-jackson-dataformats-binary | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-dataformats-text | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-jaxrs-providers | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jackson-modules-base | <0:2.9.10-2.redhat_00003.1.el6ea | 0:2.9.10-2.redhat_00003.1.el6ea |
redhat/eap7-jackson-modules-java8 | <0:2.9.10-1.redhat_00003.1.el6ea | 0:2.9.10-1.redhat_00003.1.el6ea |
redhat/eap7-jberet | <0:1.3.5-1.Final_redhat_00001.1.el6ea | 0:1.3.5-1.Final_redhat_00001.1.el6ea |
redhat/eap7-jboss-ejb-client | <0:4.0.27-1.Final_redhat_00001.1.el6ea | 0:4.0.27-1.Final_redhat_00001.1.el6ea |
redhat/eap7-jboss-server-migration | <0:1.3.1-7.Final_redhat_00007.1.el6ea | 0:1.3.1-7.Final_redhat_00007.1.el6ea |
redhat/eap7-jboss-xnio-base | <0:3.7.6-3.SP2_redhat_00001.1.el6ea | 0:3.7.6-3.SP2_redhat_00001.1.el6ea |
redhat/eap7-netty | <0:4.1.42-1.Final_redhat_00001.1.el6ea | 0:4.1.42-1.Final_redhat_00001.1.el6ea |
redhat/eap7-picketlink-bindings | <0:2.5.5-21.SP12_redhat_00010.1.el6ea | 0:2.5.5-21.SP12_redhat_00010.1.el6ea |
redhat/eap7-undertow | <0:2.0.28-2.SP1_redhat_00001.1.el6ea | 0:2.0.28-2.SP1_redhat_00001.1.el6ea |
redhat/eap7-undertow-jastow | <0:2.0.8-1.Final_redhat_00001.1.el6ea | 0:2.0.8-1.Final_redhat_00001.1.el6ea |
redhat/eap7-weld-core | <0:3.0.6-3.Final_redhat_00003.1.el6ea | 0:3.0.6-3.Final_redhat_00003.1.el6ea |
redhat/eap7-wildfly | <0:7.2.6-5.GA_redhat_00001.1.el6ea | 0:7.2.6-5.GA_redhat_00001.1.el6ea |
redhat/eap7-wildfly-http-client | <0:1.0.18-2.Final_redhat_00001.1.el6ea | 0:1.0.18-2.Final_redhat_00001.1.el6ea |
redhat/eap7-wildfly-transaction-client | <0:1.1.8-1.Final_redhat_00001.1.el6ea | 0:1.1.8-1.Final_redhat_00001.1.el6ea |
redhat/eap7-apache-cxf | <0:3.2.11-1.redhat_00001.1.el7ea | 0:3.2.11-1.redhat_00001.1.el7ea |
redhat/eap7-glassfish-jsf | <0:2.3.5-6.SP3_redhat_00004.1.el7ea | 0:2.3.5-6.SP3_redhat_00004.1.el7ea |
redhat/eap7-hal-console | <0:3.0.19-1.Final_redhat_00001.1.el7ea | 0:3.0.19-1.Final_redhat_00001.1.el7ea |
redhat/eap7-hibernate | <0:5.3.14-1.Final_redhat_00001.1.el7ea | 0:5.3.14-1.Final_redhat_00001.1.el7ea |
redhat/eap7-hibernate-validator | <0:6.0.18-1.Final_redhat_00001.1.el7ea | 0:6.0.18-1.Final_redhat_00001.1.el7ea |
redhat/eap7-jackson-annotations | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-core | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-databind | <0:2.9.10.1-1.redhat_00001.1.el7ea | 0:2.9.10.1-1.redhat_00001.1.el7ea |
redhat/eap7-jackson-dataformats-binary | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-dataformats-text | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-jaxrs-providers | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jackson-modules-base | <0:2.9.10-2.redhat_00003.1.el7ea | 0:2.9.10-2.redhat_00003.1.el7ea |
redhat/eap7-jackson-modules-java8 | <0:2.9.10-1.redhat_00003.1.el7ea | 0:2.9.10-1.redhat_00003.1.el7ea |
redhat/eap7-jberet | <0:1.3.5-1.Final_redhat_00001.1.el7ea | 0:1.3.5-1.Final_redhat_00001.1.el7ea |
redhat/eap7-jboss-ejb-client | <0:4.0.27-1.Final_redhat_00001.1.el7ea | 0:4.0.27-1.Final_redhat_00001.1.el7ea |
redhat/eap7-jboss-server-migration | <0:1.3.1-7.Final_redhat_00007.1.el7ea | 0:1.3.1-7.Final_redhat_00007.1.el7ea |
redhat/eap7-jboss-xnio-base | <0:3.7.6-3.SP2_redhat_00001.1.el7ea | 0:3.7.6-3.SP2_redhat_00001.1.el7ea |
redhat/eap7-netty | <0:4.1.42-1.Final_redhat_00001.1.el7ea | 0:4.1.42-1.Final_redhat_00001.1.el7ea |
redhat/eap7-picketlink-bindings | <0:2.5.5-21.SP12_redhat_00010.1.el7ea | 0:2.5.5-21.SP12_redhat_00010.1.el7ea |
redhat/eap7-undertow | <0:2.0.28-2.SP1_redhat_00001.1.el7ea | 0:2.0.28-2.SP1_redhat_00001.1.el7ea |
redhat/eap7-undertow-jastow | <0:2.0.8-1.Final_redhat_00001.1.el7ea | 0:2.0.8-1.Final_redhat_00001.1.el7ea |
redhat/eap7-weld-core | <0:3.0.6-3.Final_redhat_00003.1.el7ea | 0:3.0.6-3.Final_redhat_00003.1.el7ea |
redhat/eap7-wildfly | <0:7.2.6-5.GA_redhat_00001.1.el7ea | 0:7.2.6-5.GA_redhat_00001.1.el7ea |
redhat/eap7-wildfly-http-client | <0:1.0.18-2.Final_redhat_00001.1.el7ea | 0:1.0.18-2.Final_redhat_00001.1.el7ea |
redhat/eap7-wildfly-transaction-client | <0:1.1.8-1.Final_redhat_00001.1.el7ea | 0:1.1.8-1.Final_redhat_00001.1.el7ea |
redhat/eap7-apache-cxf | <0:3.2.11-1.redhat_00001.1.el8ea | 0:3.2.11-1.redhat_00001.1.el8ea |
redhat/eap7-glassfish-jsf | <0:2.3.5-6.SP3_redhat_00004.1.el8ea | 0:2.3.5-6.SP3_redhat_00004.1.el8ea |
redhat/eap7-hal-console | <0:3.0.19-1.Final_redhat_00001.1.el8ea | 0:3.0.19-1.Final_redhat_00001.1.el8ea |
redhat/eap7-hibernate | <0:5.3.14-1.Final_redhat_00001.1.el8ea | 0:5.3.14-1.Final_redhat_00001.1.el8ea |
redhat/eap7-hibernate-validator | <0:6.0.18-1.Final_redhat_00001.1.el8ea | 0:6.0.18-1.Final_redhat_00001.1.el8ea |
redhat/eap7-jackson-annotations | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-core | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-databind | <0:2.9.10.1-1.redhat_00001.1.el8ea | 0:2.9.10.1-1.redhat_00001.1.el8ea |
redhat/eap7-jackson-dataformats-binary | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-dataformats-text | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-jaxrs-providers | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jackson-modules-base | <0:2.9.10-2.redhat_00003.1.el8ea | 0:2.9.10-2.redhat_00003.1.el8ea |
redhat/eap7-jackson-modules-java8 | <0:2.9.10-1.redhat_00003.1.el8ea | 0:2.9.10-1.redhat_00003.1.el8ea |
redhat/eap7-jberet | <0:1.3.5-1.Final_redhat_00001.1.el8ea | 0:1.3.5-1.Final_redhat_00001.1.el8ea |
redhat/eap7-jboss-ejb-client | <0:4.0.27-1.Final_redhat_00001.1.el8ea | 0:4.0.27-1.Final_redhat_00001.1.el8ea |
redhat/eap7-jboss-server-migration | <0:1.3.1-7.Final_redhat_00007.1.el8ea | 0:1.3.1-7.Final_redhat_00007.1.el8ea |
redhat/eap7-jboss-xnio-base | <0:3.7.6-3.SP2_redhat_00001.1.el8ea | 0:3.7.6-3.SP2_redhat_00001.1.el8ea |
redhat/eap7-netty | <0:4.1.42-1.Final_redhat_00001.1.el8ea | 0:4.1.42-1.Final_redhat_00001.1.el8ea |
redhat/eap7-picketlink-bindings | <0:2.5.5-21.SP12_redhat_00010.1.el8ea | 0:2.5.5-21.SP12_redhat_00010.1.el8ea |
redhat/eap7-undertow | <0:2.0.28-2.SP1_redhat_00001.1.el8ea | 0:2.0.28-2.SP1_redhat_00001.1.el8ea |
redhat/eap7-undertow-jastow | <0:2.0.8-1.Final_redhat_00001.1.el8ea | 0:2.0.8-1.Final_redhat_00001.1.el8ea |
redhat/eap7-weld-core | <0:3.0.6-3.Final_redhat_00003.1.el8ea | 0:3.0.6-3.Final_redhat_00003.1.el8ea |
redhat/eap7-wildfly | <0:7.2.6-5.GA_redhat_00001.1.el8ea | 0:7.2.6-5.GA_redhat_00001.1.el8ea |
redhat/eap7-wildfly-http-client | <0:1.0.18-2.Final_redhat_00001.1.el8ea | 0:1.0.18-2.Final_redhat_00001.1.el8ea |
redhat/eap7-wildfly-transaction-client | <0:1.1.8-1.Final_redhat_00001.1.el8ea | 0:1.1.8-1.Final_redhat_00001.1.el8ea |
redhat/jackson-databind | <2.9.10 | 2.9.10 |
redhat/jackson-databind | <2.10.0 | 2.10.0 |
FasterXML jackson-databind | >=2.0.0<2.8.11.5 | |
FasterXML jackson-databind | >=2.9.0<2.9.10 | |
Netapp Active Iq Unified Manager Linux | >=7.3 | |
Netapp Active Iq Unified Manager Windows | >=7.3 | |
Netapp Active Iq Unified Manager Vmware Vsphere | >=9.5 | |
NetApp OnCommand API Services | ||
NetApp OnCommand Workflow Automation | ||
NetApp Service Level Manager | ||
Netapp Steelstore Cloud Integrated Storage | ||
Debian Debian Linux | =8.0 | |
Redhat Jboss Enterprise Application Platform | =7.2 | |
Redhat Jboss Enterprise Application Platform | =7.3 | |
Redhat Enterprise Linux | =6.0 | |
Redhat Enterprise Linux | =7.0 | |
Redhat Enterprise Linux | =8.0 | |
Oracle Customer Management And Segmentation Foundation | <18.0 | |
Oracle Goldengate Application Adapters | =19.1.0.0.0 | |
Oracle Retail Customer Management and Segmentation Foundation | =17.0 | |
Oracle WebLogic Server | =12.2.1.3.0 | |
IBM RQM | <=6.0.6.1 | |
IBM RQM | <=6.0.6 | |
IBM ETM | <=7.0.0 | |
IBM RQM | <=6.0.2 | |
IBM EWM | <=7.0 | |
IBM CLM | <=6.0.6.1 | |
IBM CLM | <=6.0.6 | |
IBM ELM | <=7.0 | |
IBM CLM | <=6.0.2 | |
IBM RDNG | <=6.0.2 | |
IBM RDNG | <=6.0.6.1 | |
IBM RDNG | <=6.0.6 | |
IBM DOORS Next | <=7.0 |
The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)