Information disclosure in jackson-databind - CVE-2019-16335

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU21136

Information disclosure in jackson-databind - CVE-2019-16335

Published: September 16, 2019 / Updated: May 26, 2020


Vulnerability identifier: #VU21136
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16335
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue in the "com.zaxxer.hikari.HikariDataSource". A remote attacker can gain unauthorized access to sensitive information on the system.


Affected software

jackson-databind
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
Dell Secure Connect Gateway
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
AMQ Streams
Apache Kafka
jackson-databind (Debian package)
jackson-databind
jackson-annotations
jackson-bom
jackson-core
jackson-parent
Cloudera Observability with IBM
Dell Support Assist Enterprise
Integration Designer
Storage Virtualize
IBM Sterling Order Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Fedora
IBM Disconnected Log Collector
watsonx.data
JBoss Data Grid
Red Hat Single Sign-On

How to mitigate CVE-2019-16335

Install update from vendor's website.

jackson-databind - addressed in versions 2.6.7.3, 2.9.9.3
AMQ Streams - update to 1.3.0
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Apache Kafka - addressed in versions 2.2.2, 2.3.1
jackson-databind (Debian package) - addressed in versions 2.8.6-1+deb9u6, 2.9.8-3+deb10u1
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Dell Secure Connect Gateway - update to 5.14.00.10
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.7.0
IBM Disconnected Log Collector - update to 1.8.3
watsonx.data - addressed in versions 2.0.2, 2.0.3
jackson-databind - addressed in versions 2.10.0-1.fc30, 2.10.0-1.fc31
jackson-annotations - addressed in versions 2.10.0-1.fc30, 2.10.0-1.fc31
jackson-bom - addressed in versions 2.10.0-1.fc30, 2.10.0-1.fc31
jackson-core - addressed in versions 2.10.0-1.fc30, 2.10.0-1.fc31
jackson-parent - addressed in versions 2.10-1.fc30, 2.10-1.fc31
JBoss Data Grid - update to 7.3.5
Red Hat Single Sign-On - update to 7.3.6
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Sterling Order Management - update to 10.0.2309.0

External References

Related Security Bulletins