Critical · published September 16, 2019
⚠️ A polymorphic typing issue in FasterXML's jackson-databind could trip up your data handling! Think of it like a restaurant menu that mixes up dish descriptions, leading to unexpected meals — your order might not match what you expected when served! If an attacker exploits this bug, they could manipulate the way data is being processed, potentially leading to unexpected behaviors in your application. While the risk isn't classified as high, misinterpreted data could still cause confusion or misconfigurations, especially in sensitive applications.
Think of it like a restaurant menu that mixes up dish descriptions, leading to unexpected meals — your order might not match what you expected when served! The polymorphic typing issue allows for improper handling of class type assignments in jackson-databind versions before 2.9.10, specifically affecting the HikariCP configuration.
If an attacker exploits this bug, they could manipulate the way data is being processed, potentially leading to unexpected behaviors in your application. While the risk isn't classified as high, misinterpreted data could still cause confusion or misconfigurations, especially in sensitive applications. To safeguard your application, upgrade jackson-databind to version 2.9.10 or later. It's also wise to review your configuration settings to ensure everything operates smoothly with the new version. You've got this! Follow these steps to keep your data handling secure and reliable! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10 | 2.9.10 |
| netapp/oncommand_api_services | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/customer_management_and_segmentation_foundation | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.2, ≤ 8.0.8 | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/goldengate_application_adapters | all versions | — |
| oracle/goldengate_stream_analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle/mysql | ≥ 5.7.0, ≤ 5.7.30 | — |
| oracle/mysql | ≥ 8.0.0, ≤ 8.0.20 | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_customer_management_and_segmentation_foundation | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/weblogic_server | all versions | — |