Polymorphic Deserialization Vulnerability in Jackson Databind
CVE-2019-14892

7.5HIGH

Key Information:

Vendor
Red Hat
Status
Jackson-databind
Vendor
CVE Published:
2 March 2020

Summary

A vulnerability exists in Jackson Databind versions prior to 2.9.10, 2.8.11.5, and 2.6.7.3, which allows for polymorphic deserialization of untrusted data. This flaw can be exploited using commons-configuration JNDI classes, potentially enabling an attacker to dynamically execute arbitrary code on the affected system. Proper validation of incoming data and restrictive deserialization practices are crucial for mitigating this risk.

Affected Version(s)

jackson-databind Versions before 2.9.10

jackson-databind Versions before 2.8.11.5

jackson-databind Versions before 2.6.7.3

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892
x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/issues/2462
x_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0729
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.