#VU18961 Information disclosure in jackson-databind


Published: 2019-07-02 | Updated: 2019-09-16

Vulnerability identifier: #VU18961

Vulnerability risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12814

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
jackson-databind
Universal components / Libraries / Libraries used by multiple products

Vendor: FasterXML

Description

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exist due to a polymorphic typing issue when Default Typing is enabled. A remote attacker can send a crafted JSON message that submits malicious input and gain access to sensitive information on the targeted system.


Mitigation
Install update from vendor's website..

Vulnerable software versions

jackson-databind: 2.9.0 - 2.9.9, 2.8.0 - 2.8.11.3, 2.7.0 - 2.7.9.5, 2.6.0 - 2.6.8, 2.5.0 - 2.5.5, 2.4.0 - 2.4.6.1, 2.3.0 - 2.3.5, 2.1.0 - 2.1.4, 2.0.0 - 2.0.4

External links
http://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5
http://github.com/FasterXML/jackson-databind/issues/2341

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in IBM Integration Designer
Multiple vulnerabilities in IBM Disconnected Log Collector
Multiple vulnerabilities in IBM Application Performance Management products
Multiple vulnerabilities in IBM Security Verify Governance
IBM Log Analysis update for FasterXML jackson-databind
Multiple vulnerabilities in z/Transaction Processing Facility
Multiple vulnerabilities in IBM Process Mining
Multiple vulnerabilities in Red Hat Fuse
Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
Apache Kafka update for jackson-databind