PT-2019-2925 · Fasterxml+2 · Jackson-Databind+2

Published 2019-01-02 · Updated 2021-03-15 · CVE-2018-19361

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.8

Description The issue is related to the failure to block the openjpa class from polymorphic deserialization in the FasterXML jackson-databind library, which can be used for parsing JSON files. This could allow a remote attacker to execute arbitrary code or cause a denial of service.

Recommendations For FasterXML jackson-databind versions 2.x before 2.9.8, update to version 2.9.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of polymorphic deserialization to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2019-2262

BDU:2019-02897

CVE-2018-19361

DLA-1703-1

DSA-4452-1

GHSA-MX9V-GMH4-MGQW

OPENSUSE-SU-2024:10868-1

RHSA-2019:0782

USN-4813-1

Affected Products

Alt Linux

Ubuntu

Jackson-Databind

References · 119

• 🔥 https://github.com/jas502n/CVE-2019-12384 · Exploit
• 🔥 https://github.com/jas502n/CVE-2020-8840 · Exploit
• 🔥 https://github.com/jas502n/jackson-CVE-2020-8840 · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-8840 · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-9548 · Exploit
• 🔥 https://github.com/LeadroyaL/cve-2019-14540-exploit · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-9547 · Exploit
• 🔥 https://github.com/MagicZer0/Jackson_RCE-CVE-2019-12384 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2019-12814 · Exploit
• 🔥 https://github.com/Veraxy00/CVE-2020-8840 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-11113 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-10673 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-14439 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2019-12086 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-14195 · Exploit