Critical · published January 2, 2019
⚠️ A polymorphic deserialization issue lurks in FasterXML's jackson-databind before version 2.9.8, allowing attackers a sneaky path to exploit it! Think of it like a chef who can't recognize the difference between real ingredients and clever imitations — a recipe could turn disastrous if the wrong item slips into the mix! While the severity is listed as unknown, this failure to block the jboss-common-core class could allow attackers to manipulate your application in unexpected ways, leading to potential data corruption or unauthorized access. It's a risky game of culinary roulette that no one wants to play!
Think of it like a chef who can't recognize the difference between real ingredients and clever imitations — a recipe could turn disastrous if the wrong item slips into the mix! This vulnerability stems from the jackson-databind library's inability to prevent polymorphic deserialization of malicious data types, specifically related to the jboss-common-core class, which could lead to unintended consequences.
While the severity is listed as unknown, this failure to block the jboss-common-core class could allow attackers to manipulate your application in unexpected ways, leading to potential data corruption or unauthorized access. It's a risky game of culinary roulette that no one wants to play! To safeguard your application, update jackson-databind to version 2.9.8 or later immediately. In addition, review your deserialization practices to ensure that you're validating input types appropriately. Don't risk the integrity of your data! You've got this! By taking these steps, you'll be reinforcing your defenses and operating like a security pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.6.0, ≤ 2.6.7.2 | — |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.5 | 2.7.9.5 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.3 | 2.8.11.3 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.8 | 2.9.8 |
| debian/debian_linux | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/business_process_management_suite | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_p6_enterprise_project_portfolio_management | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_workforce_management_software | all versions | — |
| oracle/webcenter_portal | all versions | — |
| redhat/automation_manager | all versions | — |
| redhat/decision_manager | all versions | — |
| redhat/jboss_bpm_suite | all versions | — |
| redhat/jboss_brms | all versions | — |
| redhat/openshift_container_platform | all versions | — |