Fedora 30 update for jackson-annotations, jackson-bom, jackson-core, jackson-databind



| Updated: 2025-04-25
Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2019-12086
CVE-2019-12384
CVE-2019-12814
CVE-2019-14379
CVE-2019-14439
CWE-ID CWE-200
CWE-502
CWE-20
CWE-264
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 Fedora
Operating systems & Components / Operating system

jackson-databind
Operating systems & Components / Operating system package or component

jackson-core
Operating systems & Components / Operating system package or component

jackson-bom
Operating systems & Components / Operating system package or component

jackson-annotations
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU19941

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-12086

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue when Default Typing is enabled for an externally exposed JSON endpoint and the service has the mysql-connector-java jar in the classpath. A remote attacker can send a specially crafted JSON message and read arbitrary local files on the server due to the missing "com.mysql.cj.jdbc.admin.MiniAdmin" validation.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

jackson-databind: before 2.9.9.3-1.fc30

jackson-core: before 2.9.9-1.fc30

jackson-bom: before 2.9.9-1.fc30

jackson-annotations: before 2.9.9-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-ae6a703b8f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Deserialization of Untrusted Data

EUVDB-ID: #VU19018

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-12384

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to software allows the logback-core class to process polymorphic deserialization. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

jackson-databind: before 2.9.9.3-1.fc30

jackson-core: before 2.9.9-1.fc30

jackson-bom: before 2.9.9-1.fc30

jackson-annotations: before 2.9.9-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-ae6a703b8f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU18961

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-12814

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exist due to a polymorphic typing issue when Default Typing is enabled. A remote attacker can send a crafted JSON message that submits malicious input and gain access to sensitive information on the targeted system.


Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

jackson-databind: before 2.9.9.3-1.fc30

jackson-core: before 2.9.9-1.fc30

jackson-bom: before 2.9.9-1.fc30

jackson-annotations: before 2.9.9-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-ae6a703b8f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU28624

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-14379

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Core (jackson-databind) component in Primavera Unifier. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

jackson-databind: before 2.9.9.3-1.fc30

jackson-core: before 2.9.9-1.fc30

jackson-bom: before 2.9.9-1.fc30

jackson-annotations: before 2.9.9-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-ae6a703b8f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU19933

Risk: High

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-14379

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on a targeted system.

The vulnerability exists due to the "SubTypeValidator.java" file mishandles default typing when Ehcache is used. A remote attacker can send a request that submits malicious input to the targeted system and execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

jackson-databind: before 2.9.9.3-1.fc30

jackson-core: before 2.9.9-1.fc30

jackson-bom: before 2.9.9-1.fc30

jackson-annotations: before 2.9.9-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-ae6a703b8f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU19937

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-14439

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue when Default Typing is enabled for an externally exposed JSON endpoint and the service has the logback jar in the classpath. A remote attacker can send a specially crafted JSON message and gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 30

jackson-databind: before 2.9.9.3-1.fc30

jackson-core: before 2.9.9-1.fc30

jackson-bom: before 2.9.9-1.fc30

jackson-annotations: before 2.9.9-1.fc30

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2019-ae6a703b8f


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###