PT-2019-3766 · Terracotta+4 · Ehcache+4

Published

2019-07-03

·

Updated

2023-09-13

·

CVE-2019-14379

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.7.0 through 2.7.9.5 jackson-databind versions 2.8.0 through 2.8.11.3 jackson-databind versions 2.9.0 through 2.9.9.1
Description The issue is related to the mishandling of default typing in the SubTypeValidator.java file when ehcache is used, due to the net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. This can lead to remote code execution. The vulnerability is associated with the restoration of untrusted data structures in memory, allowing a remote attacker to execute arbitrary code.
Recommendations For jackson-databind versions 2.7.0 through 2.7.9.5, update to version 2.7.9.6 or later. For jackson-databind versions 2.8.0 through 2.8.11.3, update to version 2.8.11.4 or later. For jackson-databind versions 2.9.0 through 2.9.9.1, update to version 2.9.9.2 or later. As a temporary workaround, consider disabling the use of ehcache until a patch is available. Restrict access to the SubTypeValidator.java file to minimize the risk of exploitation. Avoid using the net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup class in the affected jackson-databind versions until the issue is resolved.

Fix

RCE

Deserialization of Untrusted Data

Prototype Pollution

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2020-3030
BDU:2019-04025
BDU:2019-04087
CVE-2019-14379
DLA-1879-1
DSA-4542-1
GHSA-6FPP-RGJ9-8RWC
MGASA-2021-0153
OPENSUSE-SU-2024:10868-1
RHSA-2019:2743
RHSA-2019:2935
RHSA-2019:2936
RHSA-2019:2937
RHSA-2019:3044
RHSA-2019:3045
RHSA-2019:3046
RHSA-2024:5856
USN-4813-1

Affected Products

Alt Linux
Apple Macos
Ubuntu
Ehcache
Jackson-Databind