Critical · published July 29, 2019
🚨 A sneaky mishandling in jackson-databind could let attackers execute arbitrary code through your system! Think of it like a restaurant where the chef starts trusting any random delivery without checking the ingredients list — it could lead to a dish that's not just inedible but downright dangerous! If exploited, an attacker could gain control of your server, potentially leading to data theft, system manipulation, or even deploying malicious software. The consequences could be disastrous, especially if sensitive data is involved!
Think of it like a restaurant where the chef starts trusting any random delivery without checking the ingredients list — it could lead to a dish that's not just inedible but downright dangerous! This vulnerability arises from the SubTypeValidator.java mishandling default typing when using ehcache, allowing an attacker to send crafted data that executes arbitrary code remotely.
If exploited, an attacker could gain control of your server, potentially leading to data theft, system manipulation, or even deploying malicious software. The consequences could be disastrous, especially if sensitive data is involved! To protect your system, upgrade jackson-databind to version 2.9.9.2 or later immediately. Additionally, review your application's use of ehcache and ensure that proper validation is in place to check incoming data. You've got this! By following these steps, you can keep your systems secure and your data safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.6 | 2.7.9.6 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.4 | 2.8.11.4 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.9.2 | 2.9.9.2 |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/service_level_manager | all versions | — |
| netapp/snapcenter | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/single_sign-on | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/single_sign-on | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/single_sign-on | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_diameter_signaling_router | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.2, ≤ 8.0.8 | — |
| oracle/goldengate_stream_analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle/jd_edwards_enterpriseone_orchestrator | all versions | — |
| oracle/jd_edwards_enterpriseone_tools | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_customer_management_and_segmentation_foundation | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/siebel_engineering_-_installer_\&_deployment | ≤ 19.8 | — |
| oracle/siebel_ui_framework | ≤ 19.10 | — |
| apple/xcode | < 13.3 | 13.3 |