CVE-2019-14892 — Sensitive Information Exposure in Jackson-databind

CWE-200 — Sensitive Information ExposureCWE-502 — Deserialization of Untrusted Data8 documents7 sources
Severity
9.8CRITICALNVD
EPSS
0.9%
top 24.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Fasterxml Jackson-databindRED HAT Jackson-databindApache Geode+6 more
Timeline
PublishedMar 2
Latest updateMay 15

Description

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages9 packages

▶NVDfasterxml/jackson-databind2.0.0 — 2.6.7.3+2
▶Debianfasterxml/jackson-databind< 2.10.0-1+3
▶CVEListV5red_hat/jackson-databindVersions before 2.6.7.3, Versions before 2.8.11.5, Versions before 2.9.10+2
▶NVDapache/geode1.12.0

Also affects: Openshift Container Platform 4.3

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
OSV
Polymorphic deserialization of malicious object in jackson-databind↗2020-05-15
▶
GHSA
Polymorphic deserialization of malicious object in jackson-databind↗2020-05-15
▶
OSV
CVE-2019-14892: A flaw was discovered in jackson-databind in versions before 2↗2020-03-02
▶
CVEList
CVE-2019-14892: A flaw was discovered in jackson-databind in versions before 2↗2020-03-02
▶

📋Vendor Advisories

2
Red Hat
jackson-databind: Serialization gadgets in classes of the commons-configuration package↗2019-09-19
▶
Debian
CVE-2019-14892: jackson-databind - A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 an...↗2019
▶

💬Community

1
Bugzilla
CVE-2019-14892 jackson-databind: Serialization gadgets in classes of the commons-configuration package↗2019-10-03
▶
CVE-2019-14892 — Sensitive Information Exposure | cvebase