PT-2019-2926 · Fasterxml+2 · Jackson-Databind+2

Published 2019-01-02 · Updated 2021-03-15 · CVE-2018-19362

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.8

Description The issue is related to the FasterXML Java library for parsing JSON files, jackson-databind, and its failure to block the jboss-common-core class from polymorphic deserialization. This could allow a remote attacker to impact data integrity, access confidential data, and cause a denial of service.

Recommendations For versions 2.x before 2.9.8, update to version 2.9.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the jboss-common-core class to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALT-PU-2019-2262

BDU:2019-02898

CVE-2018-19362

DLA-1703-1

DSA-4452-1

GHSA-C8HM-7HPQ-7JHG

RHSA-2019:0782

USN-4813-1

Affected Products

Alt Linux

Ubuntu

Jackson-Databind

References · 121

• 🔥 https://github.com/jas502n/CVE-2019-12384 · Exploit
• 🔥 https://github.com/jas502n/CVE-2020-8840 · Exploit
• 🔥 https://github.com/jas502n/jackson-CVE-2020-8840 · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-8840 · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-9548 · Exploit
• 🔥 https://github.com/LeadroyaL/cve-2019-14540-exploit · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-9547 · Exploit
• 🔥 https://github.com/MagicZer0/Jackson_RCE-CVE-2019-12384 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2019-12814 · Exploit
• 🔥 https://github.com/Veraxy00/CVE-2020-8840 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-11113 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-10673 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-14439 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2019-12086 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-14195 · Exploit