Critical · published January 2, 2019
⚠️ This sneaky polymorphic deserialization issue in FasterXML's jackson-databind library could let attackers run arbitrary code on your server! Think of this like a restaurant that allows customers to substitute their meal ingredients without checking what those ingredients actually are. If they let anyone slip in a surprise ingredient, it could ruin the entire dish! An attacker could exploit this vulnerability to inject malicious code, potentially compromising your entire application. This could lead to data theft, system manipulation, or even complete server takeover—absolutely devastating outcomes!
Think of this like a restaurant that allows customers to substitute their meal ingredients without checking what those ingredients actually are. If they let anyone slip in a surprise ingredient, it could ruin the entire dish! This vulnerability arises from the failure to properly block specific classes during polymorphic deserialization within jackson-databind versions prior to 2.9.7. Attackers can leverage this flaw to execute arbitrary code remotely, posing a significant security risk.
An attacker could exploit this vulnerability to inject malicious code, potentially compromising your entire application. This could lead to data theft, system manipulation, or even complete server takeover—absolutely devastating outcomes! To protect your application, upgrade jackson-databind to version 2.9.7 or later immediately. Additionally, review the deserialization settings and consider implementing strict validation to prevent similar issues in the future. You’ve got this! By patching and enhancing your security measures, you'll be well on your way to fortifying your defenses! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.7 | 2.9.7 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_workforce_management_software | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/clusterware | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/communications_billing_and_revenue_management | all versions | — |
| oracle/database_server | all versions | — |
| oracle/database_server | all versions | — |
| oracle/database_server | all versions | — |
| oracle/database_server | all versions | — |
| oracle/database_server | all versions | — |
| oracle/enterprise_manager_for_virtualization | all versions | — |
| oracle/enterprise_manager_for_virtualization | all versions | — |
| oracle/enterprise_manager_for_virtualization | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | all versions | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/jdeveloper | all versions | — |
| oracle/jdeveloper | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| redhat/openshift_container_platform | ≥ 3.11, < 3.11.153 | 3.11.153 |
| redhat/openshift_container_platform | ≥ 4.6, < 4.6.26 | 4.6.26 |
| redhat/openshift_container_platform | ≥ 4.1, < 4.1.18 | 4.1.18 |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapcenter | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |