Permissions, Privileges, and Access Controls in jackson-databind - CVE-2019-14379
Published: August 5, 2019
Vulnerability identifier: #VU19933
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-14379
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
jackson-databind
Red Hat Software Collections
Apple Xcode
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
Dell Secure Connect Gateway
Oracle Communications Diameter Signaling Router (DSR)
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Apache Kafka
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
Red Hat Openshift Application Runtimes
JD Edwards EnterpriseOne Tools
IBM Disconnected Log Collector
Fuse
JBoss Enterprise Application Platform
JD Edwards EnterpriseOne Orchestrator
Oracle Communications Instant Messaging Server
Siebel UI Framework
Siebel Engineering - Installer & Deployment
Fedora
watsonx.data
jackson-annotations
jackson-bom
jackson-core
jackson-databind
jackson-databind
Red Hat Software Collections
Apple Xcode
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
OpenShift Logging
Dell Secure Connect Gateway
Oracle Communications Diameter Signaling Router (DSR)
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Apache Kafka
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
Red Hat OpenShift Container Platform
Red Hat Openshift Application Runtimes
JD Edwards EnterpriseOne Tools
IBM Disconnected Log Collector
Fuse
JBoss Enterprise Application Platform
JD Edwards EnterpriseOne Orchestrator
Oracle Communications Instant Messaging Server
Siebel UI Framework
Siebel Engineering - Installer & Deployment
Fedora
watsonx.data
jackson-annotations
jackson-bom
jackson-core
jackson-databind
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on a targeted system.
The vulnerability exists due to the "SubTypeValidator.java" file mishandles default typing when Ehcache is used. A remote attacker can send a request that submits malicious input to the targeted system and execute arbitrary code.
How to mitigate CVE-2019-14379
Install updates from vendor's website.