PT-2019-5806 · Jackson+2 · Jackson-Databind+2
Publicado
2019-09-19
·
Atualizado
2025-01-28
·
CVE-2019-14892
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
jackson-databind versions prior to 2.9.10
jackson-databind versions prior to 2.8.11.5
jackson-databind versions prior to 2.6.7.3
Description
The issue is related to the restoration of untrusted data in memory, which can allow a remote attacker to execute arbitrary code. This is due to a flaw in jackson-databind that permits polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes.
Recommendations
For versions prior to 2.9.10, update to version 2.9.10 or later.
For versions prior to 2.8.11.5, update to version 2.8.11.5 or later.
For versions prior to 2.6.7.3, update to version 2.6.7.3 or later.
As a temporary workaround, consider restricting the use of commons-configuration 1 and 2 JNDI classes to minimize the risk of exploitation.
Correção
Deserialization of Untrusted Data
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Commons-Configuration
Jackson-Databind