PT-2019-4596 · Jackson+7 · Jackson-Databind+7

Published

2017-11-01

·

Updated

2025-01-28

·

CVE-2019-17531

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.0.0 through 2.9.10 jackson-databind versions prior to 2.9.10.1 jackson-databind versions prior to 2.8.11.5 jackson-databind versions prior to 2.6.7.3
Description A Polymorphic Typing issue in the jackson-databind library is related to a lack of input validation mechanism. This issue can be exploited by a remote attacker to gain full control over the system. The vulnerability occurs when Default Typing is enabled for an externally exposed JSON endpoint and the service has the apache-log4j-extra jar in the classpath, allowing an attacker to execute a malicious payload by providing a JNDI service.
Recommendations For jackson-databind versions 2.0.0 through 2.9.10, update to version 2.9.10.1 or later. For jackson-databind versions prior to 2.8.11.5, update to version 2.8.11.5 or later. For jackson-databind versions prior to 2.6.7.3, update to version 2.6.7.3 or later. As a temporary workaround, consider disabling Default Typing for externally exposed JSON endpoints until a patch is available. Restrict access to the apache-log4j-extra jar in the classpath to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2020:1644
ALT-PU-2017-2557
ALT-PU-2021-1792
BDU:2020-00688
CESA-2020_1644
CVE-2019-17531
DLA-2030-1
GHSA-GJMW-VF9H-G25V
MGASA-2021-0153
OESA-2022-1782
OPENSUSE-SU-2024:10868-1
RHSA-2019:4192
RHSA-2020:0159
RHSA-2020:0160
RHSA-2020:0161
RHSA-2020:1644
RHSA-2020_1644
RHSA-2024:5856
RLSA-2020:1644
ROSA-SA-2025-2629
USN-4813-1

Affected Products

Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Ubuntu
Apache-Log4J-Extra
Jackson-Databind