Critical · published January 2, 2019
⚠️ A polymorphic deserialization flaw lurks in Jackson-databind versions before 2.9.8! This vulnerability could allow attackers a sneaky opportunity with the axis2-transport-jms class that’s just waiting to be exploited. 🔍 Think of it like a book store that lets anyone return books without checking if they were actually purchased. The absence of verification means anyone could slip in a forged return slip and swap in a different book altogether—potentially dangerous! If exploited, this vulnerability could lead to unexpected behavior in your application, allowing attackers to manipulate objects in dangerous ways. While the exact impact isn’t defined, the potential for chaos in data handling is definitely there!
Think of it like a book store that lets anyone return books without checking if they were actually purchased. The absence of verification means anyone could slip in a forged return slip and swap in a different book altogether—potentially dangerous! The flaw stems from Jackson-databind's failure to block certain classes from being deserialized, specifically the axis2-transport-jms class, creating a vector for malicious payloads to sneak in.
If exploited, this vulnerability could lead to unexpected behavior in your application, allowing attackers to manipulate objects in dangerous ways. While the exact impact isn’t defined, the potential for chaos in data handling is definitely there! To safeguard your application, update Jackson-databind to version 2.9.8 or later, ensuring that all instances of the library in your projects are patched. Additionally, review your deserialization practices to limit the classes that can be instantiated during this process. You've got this! A quick update will put you back in control—protect your app and keep those sneaky vulnerabilities at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.6.0, ≤ 2.6.7.2 | — |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.8 | 2.9.8 |
| debian/debian_linux | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_workforce_management_software | all versions | — |
| oracle/webcenter_portal | all versions | — |
| redhat/automation_manager | all versions | — |
| redhat/decision_manager | all versions | — |
| redhat/jboss_bpm_suite | all versions | — |
| redhat/jboss_brms | all versions | — |
| redhat/openshift_container_platform | all versions | — |