Input validation error in jackson-databind - CVE-2019-17531

Vulnerability identifier: #VU21750

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-17531

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected software.

The vulnerability exists due to a Polymorphic Typing in jackson-databind when processing JSON requests. A remote attacker can send specially crafted JSON data to JNDI service and execute a malicious payload.

Successful exploitation of the vulnerability requires that Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath.

jackson-databind
AMQ Streams
Red Hat Software Collections
z/Transaction Processing Facility ( z/TPF)
Log Analysis
IBM Process Mining
Dell Secure Connect Gateway
Unified Mediation Bus
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
Apache Kafka
Cloudera Observability with IBM
Dell Support Assist Enterprise
Oracle Business Intelligence Enterprise Edition
Integration Designer
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Storage Virtualize
IBM Sterling Order Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
openEuler
Oracle WebCenter Portal
Oracle GoldenGate Application Adapters
IBM Disconnected Log Collector
watsonx.data
jackson-databind-javadoc
jackson-databind
Red Hat Single Sign-On

Install update from vendor's website.

jackson-databind - addressed in versions 2.6.7.3, 2.9.10.1
AMQ Streams - update to 1.4.0
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002, 1.3.7.2 IF003
IBM Process Mining - update to 1.12.0.4
Apache Kafka - addressed in versions 2.2.2, 2.3.1
Cloudera Observability with IBM - update to 3.6.2
Dell Support Assist Enterprise - update to 4.00.06.00
Dell Secure Connect Gateway - update to 5.14.00.10
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.7.0
IBM Disconnected Log Collector - update to 1.8.3
watsonx.data - addressed in versions 2.0.2, 2.0.3
jackson-databind-javadoc - update to 2.9.8-8
jackson-databind - update to 2.9.8-8
Unified Mediation Bus - update to 4.4
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
Red Hat Single Sign-On - update to 7.3.6
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
IBM Security Verify Governance - update to 10.0.1.0.4
IBM Sterling Order Management - update to 10.0.2309.0

• https://github.com/FasterXML/jackson-databind/issues/2498
• https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

• Multiple vulnerabilities in FasterXML jackson-databind
• Apache Kafka update for jackson-databind
• Red Hat Software Collections update for rh-maven35-jackson-databind
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat AMQ Streams
• Red Hat Enterprise Linux 8 update for the pki-core:10.6 and pki-deps:10.6 modules
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle GoldenGate Application Adapters
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in z/Transaction Processing Facility
• Multiple vulnerabilities in Dell Secure Connect Gateway
• IBM Log Analysis update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in HPE Unified Mediation Bus (UMB)
• Multiple vulnerabilities in IBM Disconnected Log Collector
• openEuler update for jackson-databind
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in IBM watsonx.data
• IBM watsonx.data update for FasterXML jackson-databind
• Multiple vulnerabilities in Red Hat Single Sign-On 7.3
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM