CVE-2019-14893
jackson-databind: Serialization gadgets in classes of the xalan package
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
Se detectó un fallo en FasterXML jackson-databind en todas las versiones anteriores a 2.9.10 y 2.10.0, donde permitiría la deserialización polimórfica de objetos maliciosos usando el gadget xalan JNDI cuando se utiliza en conjunto con métodos de manejo de tipos polimórficos como "enableDefaultTyping()" o cuando @JsonTypeInfo está usando "Id.CLASS" o "Id.MINIMAL_CLASS" o de cualquier otra manera en que ObjectMapper.readValue pueda crear instancias de objetos de fuentes no seguras. Un atacante podría usar este fallo para ejecutar código arbitrario.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-08-10 CVE Reserved
- 2020-01-20 CVE Published
- 2024-01-05 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://github.com/FasterXML/jackson-databind/issues/2469 | Third Party Advisory | |
| https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E | Mailing List | |
| https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E | Mailing List | |
| https://security.netapp.com/advisory/ntap-20200327-0006 | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpujul2020.html | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpuoct2020.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893 | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2020:0729 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2019-14893 | 2020-07-28 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1758182 | 2020-07-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fasterxml Search vendor "Fasterxml" | Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind" | >= 2.8.0 < 2.8.11.5 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.8.0 < 2.8.11.5" | - |
Affected
| ||||||
| Fasterxml Search vendor "Fasterxml" | Jackson-databind Search vendor "Fasterxml" for product "Jackson-databind" | >= 2.9.0 < 2.9.10 Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.9.0 < 2.9.10" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Api Services Search vendor "Netapp" for product "Oncommand Api Services" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Steelstore Cloud Integrated Storage Search vendor "Netapp" for product "Steelstore Cloud Integrated Storage" | - | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Goldengate Stream Analytics Search vendor "Oracle" for product "Goldengate Stream Analytics" | < 19.1.0.0.1 Search vendor "Oracle" for product "Goldengate Stream Analytics" and version " < 19.1.0.0.1" | - |
Affected
| ||||||