Deserialization of Untrusted Data in jackson-databind - CVE-2019-12384

Vulnerability identifier: #VU19018

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2019-12384

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Apache Kafka
jackson-databind (Debian package)
rh-maven35-jackson-databind (Red Hat package)
jackson-bom
jackson-annotations
jackson-core
jackson-databind
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
Red Hat Openshift Application Runtimes
IBM Disconnected Log Collector
Fuse
JBoss Enterprise Application Platform
Red Hat Enterprise Linux for x86_64
Fedora
watsonx.data
Operational Decision Manager

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to software allows the logback-core class to process polymorphic deserialization. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://doyensec.com/research.html
• https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad
• https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
• https://security.netapp.com/advisory/ntap-20190703-0002/