Deserialization of Untrusted Data in jackson-databind - CVE-2022-42003

Vulnerability identifier: #VU68635

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-42003

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
jackson-databind
Debian Linux
Gentoo Linux
Oracle Solaris Cluster
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
openSUSE Leap
openEuler
Fedora
CICS Transaction Gateway
Migration Toolkit for Runtimes
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Party Management
Oracle Banking Enterprise Default Management
Oracle Banking Loans Servicing
Jira Service Management Server
Jira Service Management Data Center
Crowd Data Center
Dell Secure Connect Gateway
OpenShift Logging
IBM Spectrum Control
IBM Sterling B2B Integrator
Oracle Communications Unified Inventory Management
Jira Software Data Center
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Enterprise Case Management
Oracle Communications Diameter Intelligence Hub
Oracle Communications Session Report Manager
Oracle Health Sciences Empirica Signal
Oracle SD-WAN Edge
Oracle Identity Manager Connector
Enterprise Manager Base Platform
Oracle Banking Trade Finance
Oracle Banking Treasury Management
Oracle Communications Cloud Native Core Network Data Analytics Function
Management Cloud Engine
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Splunk AppDynamics Database Agent
IBM Operations Analytics Predictive Insights
Sterling Connect Direct File Agent
Netcool Operations Insight
IBM Process Mining
IBM Cloud Pak for Multicloud Management Monitoring
IBM Fusion HCI
Red Hat build of Quarkus
Red Hat Integration Camel Extensions for Quarkus
Financial Transaction Manager for ACH Services and Check Services
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Sterling Connect:Direct for UNIX
Unified Mediation Bus
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Sterling Connect:Direct Web Services
IBM Sterling Partner Engagement Manager
Red Hat Satellite
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
IBM Common Licensing
IBM MQ
IBM Security Verify Governance
EMC Data Protection Advisor
NetWorker
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Oracle Graph Server and Client
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Operations Dashboard
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
Guardium Data Security Center (GDSC)
Cloudera Observability with IBM
Security QRadar EDR
Oracle Utilities Framework
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
Oracle Financial Services Analytical Applications Infrastructure
Datacap
IBM Engineering Requirements Management DOORS Next
IBM Security Verify Information Queue
Oracle Communications Policy Management
Oracle Application Testing Suite
Oracle FLEXCUBE Universal Banking
Oracle Retail Service Backbone
Oracle FLEXCUBE Investor Servicing
Oracle Retail Xstore Point of Service
Oracle Banking Digital Experience
Integration Designer
Oracle Siebel CRM
Db2 Graph
DataPower Operations Dashboard
IBM i Modernization Engine for Lifecycle Integration
Dell EMC Streaming Data Platform
IBM Planning Analytics Workspace
Answer Retrieval for Watson Discovery On Prem
Netezza Performance Server Replication Services
Tivoli Netcool/OMNIbus Integration - Probe for Microsoft Exchange Web Services
PowerStore T
PowerStore X
IBM Cloud Pak for Watson AIOps
Watson CP4D Data Stores
IBM Sterling Connect:Direct for Microsoft Windows
User Entity Behavior Analytics
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
MobileFirst Platform
Storage Protect Server
Storage Virtualize
OpenPages for IBM Cloud Pak for Data
webMethods Integration Server
webMethods BPM
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
IBM Data Risk Manager
Oracle Financial Services Crime and Compliance Management Studio
Oracle Communications Element Manager
Oracle Business Process Management Suite
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle Banking Extensibility Workbench
Oracle Banking Trade Finance Process Management
Oracle Banking Liquidity Management
Oracle Banking Corporate Lending Process Management
Oracle Banking Virtual Account Management
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
Stream Analytics
IBM Cloud Pak System
IBM App Connect for Manufacturing
JD Edwards EnterpriseOne Tools
Enterprise Manager for Virtualization
Primavera Unifier
Oracle Autovue for Agile Product Lifecycle Management
IBM Disconnected Log Collector
IBM Spectrum Protect Backup-Archive Client
Oracle Healthcare Translational Research
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Retail Sales Audit
Siebel CRM Deployment
Crowd Server
Red Hat Single Sign-On
Communications Unified Assurance
Oracle Communications Calendar Server
Oracle Communications Contacts Server
Oracle Communications Instant Messaging Server
Oracle Communications Billing and Revenue Management
Voice Gateway
IBM Sterling Global Mailbox (GM)
JBoss Enterprise Application Platform
AMQ Broker
Oracle Coherence
Primavera Gateway
AMQ Streams
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Banking Corporate Lending
Jira Software Server
JBoss Data Grid
Jazz Reporting Service
IBM Qradar SIEM
IBM Cognos Command Center
Splunk Enterprise
PeopleSoft Enterprise PeopleTools
Oracle Documaker
Operational Decision Manager
IBM Cognos Analytics
Oracle Agile PLM Framework
IBM App Connect Enterprise
Red Hat Camel for Spring Boot
Oracle SQL Developer
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Merchandising System
Oracle Retail Customer Management and Segmentation Foundation
Identity Manager
Oracle GoldenGate
Oracle NoSQL Database
Oracle Database Server
IBM InfoSphere Information Server
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Security Edge Protection Proxy
IBM Spectrum Protect for Space Management
Cloud Foundry UAA
eap7-jboss-jsp (Red Hat package)
eap7-jboss-jsf (Red Hat package)
eap7-javaee-security-soteria (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-velocity (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-snakeyaml (Red Hat package)
QuMagie Mobile
eap7-undertow (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-apache-sshd (Red Hat package)
jackson-databind
jackson-databind-javadoc
eap7-jackson-core (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
jackson-databind (Debian package)
dev-java/jackson-databind
jackson-parent
jackson-bom
jackson-modules-base
jackson-core
jackson-jaxrs-providers
jackson-annotations
jenkins (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate-search (Red Hat package)
eap7-woodstox-core (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)
fasterxml-oss-parent
watsonx.data
Red Hat build of Eclipse Vert.x
IBM FileNet Content Manager
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V
Content Manager Enterprise Edition
Wildfly

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure input validation when processing serialized data when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. A remote attacker can pass specially crafted data to the application and cause a denial of service condition on the target system.

Install updates from vendor's website.

• https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51020
• https://github.com/FasterXML/jackson-databind/issues/3590