PT-2019-12628 · Mapr+1 · Mapr Core Platform+1

Publicado 2019-10-24 · Atualizado 2020-08-24 · CVE-2019-12017

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MapR core platform (affected versions not specified)

Description A remote code execution issue exists in the MapR CLDB code, specifically in the JSON framework used for login and ticket issuance. An attacker can manipulate the class property of a JSON request to influence the JSON library's deserialization decision, forcing the MapR CLDB to load a malicious Java class from a remote path and execute arbitrary code on the machine running the MapR CLDB, potentially taking over the cluster.

Recommendations To resolve this issue, switch to the newer Jackson library and ensure that all incoming JSON requests are only deserialized to the same class that it was serialized from.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-12017

Produtos afetados

Jackson Library

Mapr Core Platform

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-12017 · Nota de Segurança
• https://mapr.com/support/s/article/Remote-code-execution-vulnerability-in-MapR-MFS-CLDB?language=en_US · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12017 · Aviso do Fabricante