PT-2019-4596 · Jackson+7 · Jackson-Databind+7
Publicado
2017-11-01
·
Atualizado
2025-01-28
·
CVE-2019-17531
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
jackson-databind versions 2.0.0 through 2.9.10
jackson-databind versions prior to 2.9.10.1
jackson-databind versions prior to 2.8.11.5
jackson-databind versions prior to 2.6.7.3
Description
A Polymorphic Typing issue in the jackson-databind library is related to a lack of input validation mechanism. This issue can be exploited by a remote attacker to gain full control over the system. The vulnerability occurs when Default Typing is enabled for an externally exposed JSON endpoint and the service has the apache-log4j-extra jar in the classpath, allowing an attacker to execute a malicious payload by providing a JNDI service.
Recommendations
For jackson-databind versions 2.0.0 through 2.9.10, update to version 2.9.10.1 or later.
For jackson-databind versions prior to 2.8.11.5, update to version 2.8.11.5 or later.
For jackson-databind versions prior to 2.6.7.3, update to version 2.6.7.3 or later.
As a temporary workaround, consider disabling Default Typing for externally exposed JSON endpoints until a patch is available.
Restrict access to the apache-log4j-extra jar in the classpath to minimize the risk of exploitation.
Exploit
Correção
Deserialization of Untrusted Data
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Ubuntu
Apache-Log4J-Extra
Jackson-Databind