Deserialization of Untrusted Data in jackson-databind and jackson-core - CVE-2021-46877

Vulnerability identifier: #VU59148

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-46877

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure input validation when processing serialized JsonNode values. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Note, the vulnerability affects JDK serialization only.

jackson-databind
jackson-core
ObjectScale
Spectator
IBM Engineering Requirements Management DOORS Next
Oracle Data Integrator
Business Automation Insights
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
Red Hat Openshift Application Runtimes
Amazon Linux AMI
Migration Toolkit for Runtimes
Jira Service Management Data Center
Jira Service Management Server
Crowd Data Center
Jira Software Data Center
IBM MQ
IBM Cloud Pak for Business Automation
Splunk AppDynamics Database Agent
Red Hat Integration - Service Registry
Financial Transaction Manager for ACH Services and Check Services
IBM Cloud Transformation Advisor
Unified Mediation Bus
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat Migration Toolkit for Applications
IBM Tivoli Netcool Impact
IBM Security Verify Governance
EMC Data Protection Advisor
Crowd Server
Red Hat Single Sign-On
JBoss Enterprise Application Platform
AMQ Streams
Jira Software Server
Cloud Pak for Security (CP4S)
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap7-glassfish-jaf (Red Hat package)
eap7-jettison (Red Hat package)
eap7-glassfish-javamail (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
QuMagie Mobile
eap7-undertow (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-picketlink-bindings (Red Hat package)
eap7-xalan-j2 (Red Hat package)
jackson-databind
eap7-activemq-artemis (Red Hat package)
jenkins (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-protostream (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
Red Hat Camel for Spring Boot

Install updates from vendor's website.

jackson-databind - addressed in versions 2.12.6, 2.13.1
jackson-core - addressed in versions 2.12.6, 2.13.1
Migration Toolkit for Runtimes - update to 1.1.0
ObjectScale - update to 1.3.0
Spectator - update to 1.0.13
Jira Service Management Data Center - update to 4.20.27
Jira Service Management Server - update to 4.20.27
Crowd Data Center - update to 7.1.1
Crowd Server - update to 7.1.1
JBoss Enterprise Application Platform - update to 7.4.12
Red Hat Single Sign-On - update to 7.6.5
Jira Software Server - addressed in versions 8.20.28, 9.4.12, 9.11.3
Jira Software Data Center - addressed in versions 8.20.28, 9.4.12, 9.11.3
IBM MQ - update to 9.2.4 CD
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
Splunk AppDynamics Database Agent - update to 26.1.0
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.0.9-1.redhat_00001.1.el7eap, 1.0.9-1.redhat_00001.1.el8eap, 1.0.9-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.0.9-1.redhat_00001.1.el7eap, 1.0.9-1.redhat_00001.1.el8eap, 1.0.9-1.redhat_00001.1.el9eap
eap7-glassfish-jaf (Red Hat package) - addressed in versions 1.2.2-2.redhat_00002.1.el7eap, 1.2.2-2.redhat_00002.1.el8eap, 1.2.2-2.redhat_00002.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.5.4-1.redhat_00002.1.el7eap, 1.5.4-1.redhat_00002.1.el8eap, 1.5.4-1.redhat_00002.1.el9eap
eap7-glassfish-javamail (Red Hat package) - addressed in versions 1.6.7-2.redhat_00003.1.el7eap, 1.6.7-2.redhat_00003.1.el8eap, 1.6.7-2.redhat_00003.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-30.Final_redhat_00029.1.el7eap, 1.10.0-30.Final_redhat_00029.1.el8eap, 1.10.0-30.Final_redhat_00029.1.el9eap
Cloud Pak for Security (CP4S) - update to 1.10.14.0
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.17-1.Final_redhat_00001.1.el7eap, 1.15.17-1.Final_redhat_00001.1.el8eap, 1.15.17-1.Final_redhat_00001.1.el9eap
QuMagie Mobile - update to 2.2.0.0126
eap7-undertow (Red Hat package) - addressed in versions 2.2.25-3.SP3_redhat_00001.1.el7eap, 2.2.25-3.SP3_redhat_00001.1.el8eap, 2.2.25-3.SP3_redhat_00001.1.el9eap
AMQ Streams - update to 2.4.0
Red Hat Integration - Service Registry - update to 2.4.3
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-23.SP12_redhat_00013.1.el7eap, 2.5.5-23.SP12_redhat_00013.1.el8eap, 2.5.5-23.SP12_redhat_00013.1.el9eap
eap7-picketlink-bindings (Red Hat package) - addressed in versions 2.5.5-27.SP12_redhat_00016.1.el7eap, 2.5.5-27.SP12_redhat_00016.1.el8eap, 2.5.5-27.SP12_redhat_00016.1.el9eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-36.redhat_00014.1.el7eap, 2.7.1-36.redhat_00014.1.el8eap, 2.7.1-36.redhat_00014.1.el9eap
jackson-databind - update to 2.11.4-6
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-12.redhat_00048.1.el7eap, 2.16.0-12.redhat_00048.1.el8eap, 2.16.0-12.redhat_00048.1.el9eap
jenkins (Red Hat package) - addressed in versions 2.387.3.1684911776-3.el8, 2.401.1.1686649641-3.el8
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
eap7-hal-console (Red Hat package) - addressed in versions 3.3.18-1.Final_redhat_00001.1.el7eap, 3.3.18-1.Final_redhat_00001.1.el8eap, 3.3.18-1.Final_redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.10.0
Red Hat Camel for Spring Boot - update to 3.18.3 Patch 2
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.53-1.Final_redhat_00001.1.el7eap, 4.0.53-1.Final_redhat_00001.1.el8eap, 4.0.53-1.Final_redhat_00001.1.el9eap
eap7-protostream (Red Hat package) - addressed in versions 4.3.5-2.Final_redhat_00003.1.el7eap, 4.3.5-2.Final_redhat_00003.1.el8eap, 4.3.5-2.Final_redhat_00003.1.el9eap
Unified Mediation Bus - update to 4.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
jenkins-2-plugins (Red Hat package) - addressed in versions 4.12.1686649756-1.el8, 4.13.1684911916-1.el8
eap7-hibernate (Red Hat package) - addressed in versions 5.3.30-1.Final_redhat_00001.1.el7eap, 5.3.30-1.Final_redhat_00001.1.el8eap, 5.3.30-1.Final_redhat_00001.1.el9eap
Red Hat Migration Toolkit for Applications - update to 6.2.0
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix020, 7.1.0 iFix006
IBM Tivoli Netcool Impact - update to 7.1.0.26
eap7-wildfly (Red Hat package) - addressed in versions 7.4.12-3.GA_redhat_00003.1.el7eap, 7.4.12-3.GA_redhat_00003.1.el8eap, 7.4.12-3.GA_redhat_00003.1.el9eap
IBM Security Verify Governance - update to 10.0.2.0.1
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.9-1.redhat_00001.1.el7sso, 18.0.9-1.redhat_00001.1.el8sso, 18.0.9-1.redhat_00001.1.el9sso
EMC Data Protection Advisor - update to 19.10 B46

• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698
• https://github.com/FasterXML/jackson-databind/issues/3328
• https://github.com/FasterXML/jackson-databind/commit/3ccde7d938fea547e598fdefe9a82cff37fed5cb

• Denial of service in FasterXML jackson
• spectator update for FasterXML jackson
• IBM MQ update for FasterXML jackson-databind
• Deserialization of untrusted data in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• OpenShift Developer Tools and Services for OCP 4.13 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• OpenShift Developer Tools and Services for OCP 4.12 update for jenkins and jenkins-2-plugins
• Deserialization of untrusted data in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in Red Hat Integration - Service Registry
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in Red Hat Openshift Application Runtimes
• Red Hat Single Sign-On 7.6.5 security update on RHEL 9
• Red Hat Single Sign-On 7.6.5 security update on RHEL 8
• Red Hat Single Sign-On 7.6.5 security update on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot 3.18
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Jira Service Management Data Center and Server update for jackson-databind
• Multiple vulnerabilities in IBM Engineering Lifecycle Optimization - Publishing
• Multiple vulnerabilities in third-party components in Jira Software Data Center and Server
• Multiple vulnerabilities in HPE Unified Mediation Bus (UMB)
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in QNAP QuMagie Mobile for Android
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager, Software component
• Multiple vulnerabilities in Data Protection Advisor
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for jackson-databind
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Business Automation Insights
• Crowd Data Center and Server update for jackson-databind dependency
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Engineering Lifecycle Management - Jazz Foundation
• Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform
• Splunk AppDynamics Database Agent update for third-party components