REDHAT-BUG-1758191
First published: Thu Oct 03 2019(Updated: )
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling. Upstream issue: <a href="https://github.com/FasterXML/jackson-databind/issues/2478">https://github.com/FasterXML/jackson-databind/issues/2478</a> Upstream patch: <a href="https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f">https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f</a> <a href="https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b">https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b</a> <a href="https://github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8">https://github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8</a> References: <a href="https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062">https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FasterXML Jackson Databind | >=2.0.0<=2.9.10 | |
| p6spy |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/FasterXML/jackson-databind/issues/2478
- https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f
- https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b
- https://github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1758193
- https://github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0161
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/security/cve/cve-2019-16943
- https://access.redhat.com/errata/RHSA-2020:0445
- https://access.redhat.com/errata/RHSA-2020:0895
- https://access.redhat.com/errata/RHSA-2020:0899
- https://access.redhat.com/errata/RHSA-2020:0939
- https://access.redhat.com/errata/RHSA-2020:1644
- https://access.redhat.com/errata/RHSA-2020:2067
- https://access.redhat.com/errata/RHSA-2020:2321
- https://access.redhat.com/errata/RHSA-2020:2333
- https://access.redhat.com/errata/RHSA-2020:3192
- https://bugzilla.redhat.com/show_bug.cgi?id=1758191
Frequently Asked Questions
What is the severity of REDHAT-BUG-1758191?
The severity of REDHAT-BUG-1758191 is considered critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-1758191?
To fix REDHAT-BUG-1758191, you should upgrade Jackson Databind to version 2.10.0 or later.
What versions are affected by REDHAT-BUG-1758191?
Versions of FasterXML jackson-databind from 2.0.0 through 2.9.10 are affected by REDHAT-BUG-1758191.
What is the risk of not addressing REDHAT-BUG-1758191?
Not addressing REDHAT-BUG-1758191 may allow attackers to execute arbitrary code on your server via exposed JSON endpoints.
Is p6spy related to the vulnerability REDHAT-BUG-1758191?
Yes, the presence of p6spy in the classpath can trigger the vulnerability outlined in REDHAT-BUG-1758191.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-16943
- agent/source
- agent/references
- agent/description
- agent/severity
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fasterxml
- canonical/fasterxml jackson databind
- vendor/p6spy
- canonical/p6spy