FLAT-1KUT8 – Vulnerability | Fluid Attacks Database

Database

Description

Deserialization of Untrusted Data in FasterXML jackson-databind FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	jackson-databind	>=0 <2.9.8-3	2.9.8-3
debian 13	jackson-databind	>=0 <2.9.8-3	2.9.8-3
debian 12	jackson-databind	>=0 <2.9.8-3	2.9.8-3
debian 11	jackson-databind	>=0 <2.9.8-3	2.9.8-3
maven	com.fasterxml.jackson.core:jackson-databind	>=2.9.0 <2.9.9.1 \|\| >=2.8.0 <2.8.11.4 \|\| >=2.7.0 <2.7.9.6 \|\| >=2.0.0 <2.6.7.3	2.9.9.1, 2.8.11.4, 2.7.9.6, 2.6.7.3

References

1. https://github.com/jas502n/CVE-2019-123842. https://github.com/FasterXML/jackson-databind/issues/23343. https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be2344. https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E5. https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E6. https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E7. https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E8. https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E9. https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E10. https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E11. https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E12. https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E13. https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E14. https://lists.fedoraproject.org/archives/list/[email protected]/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL15. https://lists.fedoraproject.org/archives/list/[email protected]/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B54416. https://lists.fedoraproject.org/archives/list/[email protected]/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC17. https://seclists.org/bugtraq/2019/Oct/618. https://security.netapp.com/advisory/ntap-20190703-000219. https://www.debian.org/security/2019/dsa-454220. https://www.oracle.com/security-alerts/cpuapr2020.html21. https://www.oracle.com/security-alerts/cpujan2020.html22. https://www.oracle.com/security-alerts/cpujul2020.html23. https://www.oracle.com/security-alerts/cpuoct2020.html24. https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html25. https://blog.doyensec.com/2019/07/22/jackson-gadgets.html26. https://doyensec.com/research.html27. https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad28. https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E29. https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E30. https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E31. https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E32. https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E33. https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.