Critical · published July 9, 2019
⚠️ A sneaky combination of default typing and a gadget class can lead to unauthorized data exfiltration in Jackson databind versions 2.0.0 through 2.9.5! 🔥 Think of it like an overly trusting mailroom that delivers sensitive packages just because they look familiar—no questions asked! This vulnerability lets attackers smuggle out valuable data without raising any alarms. An attacker could exploit this by sending specially crafted data, making it possible to access and exfiltrate sensitive information from your application. Imagine the chaos if confidential user data or business secrets were leaked without your knowledge!
Think of it like an overly trusting mailroom that delivers sensitive packages just because they look familiar—no questions asked! This vulnerability lets attackers smuggle out valuable data without raising any alarms. This vulnerability occurs due to the use of Jackson's default typing coupled with a gadget class from iBatis, which can be manipulated to exfiltrate content unexpectedly, resulting in potential data breaches.
An attacker could exploit this by sending specially crafted data, making it possible to access and exfiltrate sensitive information from your application. Imagine the chaos if confidential user data or business secrets were leaked without your knowledge! To protect your application, upgrade Jackson databind to versions 2.7.9.4, 2.8.11.2, or 2.9.6 immediately. It's also wise to review your usage of default typing and consider alternatives if possible. Don't let this vulnerability linger! You've got this! With a quick upgrade, you'll be one step closer to your security hero status! 🦸
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.4 | 2.7.9.4 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.2 | 2.8.11.2 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.6 | 2.9.6 |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| oracle/clusterware | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/retail_customer_management_and_segmentation_foundation | all versions | — |
| oracle/utilities_advanced_spatial_and_operational_analytics | all versions | — |