CVE-2019-17531
on github
Published
Severity
CVSS v3:
9.8 CRITICAL
CVSS v2:
6.8 MEDIUM
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
References
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/2498
- https://security.netapp.com/advisory/ntap-20191024-0005/
- https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5@%3Ccommits.pulsar.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:4192
- https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/errata/RHSA-2020:0161
- https://access.redhat.com/errata/RHSA-2020:0445
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
Configurations
CPE23 | Version Start | Version End | Exact Version |
---|---|---|---|
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.8.0 (including) | 2.8.11.5 | * |
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.6.0 (including) | 2.6.7.3 | * |
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.9.0 (including) | 2.9.10.1 | * |
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | n/a | n/a | 8.0 |
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* | n/a | n/a | 2.4.0 |
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* | n/a | n/a | 9.2 |
cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:* | n/a | n/a | 2.4.1 |
cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:* | n/a | n/a | 16.1 |
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* | n/a | n/a | 16.2 |
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:* | n/a | n/a | 2.5.0 |
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.3.0 |
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.3.0 |
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.3.0 |
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* | n/a | n/a | 2.6.0 |
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* | n/a | n/a | 2.6.1 |
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* | n/a | n/a | 2.6.2 |
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* | n/a | n/a | 7.5.0.23.0 |
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* | n/a | n/a | 12.0.0.3.0 |
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:* | n/a | n/a | 13.9.4.2.2 |
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:* | n/a | n/a | 9.2 |
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:* | n/a | n/a | 15.0.3 |
cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:* | n/a | n/a | 16.0.2 |
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* | n/a | n/a | 16.0.3 |
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:* | n/a | n/a | 14.1 |
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:* | n/a | 2.20.5 (including) | * |
cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:* | n/a | n/a | 12.2.0.1 |
cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:* | n/a | n/a | 18c |
cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:* | n/a | n/a | 19c |
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.4.0 |
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.4.0 |
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.4.0 |
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* | n/a | n/a | 2.7.0 |
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* | n/a | n/a | 2.7.1 |
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* | n/a | n/a | 2.9.0 |
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:* | n/a | n/a | 8.0.0.2.0 |
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:* | n/a | n/a | 8.0.0.3.0 |
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* | n/a | n/a | 7.1 |
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.3.0 |
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:* | n/a | n/a | 12.2.1.4.0 |
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* | n/a | n/a | 19.1.0.0.0 |
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 17.7 (including) | 17.12.6 (including) | * |
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 18.8.0 (including) | 18.8.8 (including) | * |
cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:* | n/a | n/a | 19.12.0 |
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | n/a | n/a | - |
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | n/a | n/a | - |
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* | n/a | n/a | 1.2.1 |
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.0.0 (including) | 2.6.7.3 | * |
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.7.0 (including) | 2.8.11.5 | * |