High · published March 21, 2019
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.4 | 2.7.9.4 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.2 | 2.8.11.2 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.6 | 2.9.6 |
| debian/debian_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| redhat/automation_manager | all versions | — |
| redhat/decision_manager | all versions | — |
| redhat/jboss_brms | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/single_sign-on | all versions | — |