CVE-2019-16335CWE-502insecure-deserialization

CVE-2019-16335

Critical · published September 16, 2019

CVSS v3.1
9.8
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

⚠️ A polymorphic typing issue in FasterXML's jackson-databind could lead to unexpected behavior. It's like a chef mistaking salt for sugar in a recipe! 🍳 Think of it as a restaurant where the chef mislabels ingredients, resulting in an unexpected dish that may not be safe for diners with allergies. In the same way, this vulnerability could lead to unexpected behaviors in software depending on the data types it processes. If exploited, this flaw could cause unpredictable results in applications relying on jackson-databind, potentially leading to data corruption or application crashes. While there's no known exploitation yet, the risk of future vulnerabilities arising from these polymorphic typing issues makes it essential to address.

Put simply

Think of it as a restaurant where the chef mislabels ingredients, resulting in an unexpected dish that may not be safe for diners with allergies. In the same way, this vulnerability could lead to unexpected behaviors in software depending on the data types it processes. The polymorphic typing vulnerability in jackson-databind prior to version 2.9.10 arises from improper handling of certain data types, which could allow an attacker to manipulate data in ways the application doesn't expect, leading to unpredictable behavior.

What to do

If exploited, this flaw could cause unpredictable results in applications relying on jackson-databind, potentially leading to data corruption or application crashes. While there's no known exploitation yet, the risk of future vulnerabilities arising from these polymorphic typing issues makes it essential to address. Upgrade jackson-databind to version 2.9.10 or later to mitigate this issue. Additionally, review your application's usage of data binding to ensure all data types are properly validated and handled. Don't wait—better to be safe than sorry! You've got this! By addressing this vulnerability promptly, you're keeping your applications secure and user trust intact! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04918 · 92.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2019-09-16T02:15Z
Affected products (39)
ProductVersionsFixed in
fasterxml/jackson-databind≥ 2.0.0, < 2.6.7.32.6.7.3
fasterxml/jackson-databind≥ 2.7.0, < 2.8.11.52.8.11.5
fasterxml/jackson-databind≥ 2.9.0, < 2.9.102.9.10
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
netapp/oncommand_api_servicesall versions—
netapp/oncommand_workflow_automationall versions—
netapp/steelstore_cloud_integrated_storageall versions—
redhat/jboss_enterprise_application_platformall versions—
redhat/jboss_enterprise_application_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/customer_management_and_segmentation_foundationall versions—
oracle/financial_services_analytical_applications_infrastructure≥ 8.0.2, ≤ 8.0.8—
oracle/global_lifecycle_management_opatch< 11.2.0.3.2311.2.0.3.23
oracle/global_lifecycle_management_opatch≥ 12.2.0.1.0, < 12.2.0.1.1912.2.0.1.19
oracle/global_lifecycle_management_opatch≥ 13.9.4.0.0, < 13.9.4.2.113.9.4.2.1
oracle/goldengate_application_adaptersall versions—
oracle/goldengate_stream_analytics< 19.1.0.0.119.1.0.0.1
oracle/primavera_gateway≥ 17.7, ≤ 17.12—
oracle/primavera_gatewayall versions—
oracle/primavera_gatewayall versions—
oracle/primavera_gatewayall versions—
oracle/primavera_gatewayall versions—
oracle/retail_customer_management_and_segmentation_foundationall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/weblogic_serverall versions—
References (64)
https://access.redhat.com/errata/RHSA-2019:3200 · [email protected]https://access.redhat.com/errata/RHSA-2020:0159 · [email protected]https://access.redhat.com/errata/RHSA-2020:0160 · [email protected]https://access.redhat.com/errata/RHSA-2020:0161 · [email protected]https://access.redhat.com/errata/RHSA-2020:0164 · [email protected]https://access.redhat.com/errata/RHSA-2020:0445 · [email protected]https://access.redhat.com/errata/RHSA-2020:0729 · [email protected]https://github.com/FasterXML/jackson-databind/issues/2449 · [email protected]https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E · [email protected]https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E · [email protected]https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E · [email protected]https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E · [email protected]https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E · [email protected]https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E · [email protected]https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E · [email protected]https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E · [email protected]https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E · [email protected]https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E · [email protected]https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E · [email protected]https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/ · [email protected]https://seclists.org/bugtraq/2019/Oct/6 · [email protected]https://security.netapp.com/advisory/ntap-20191004-0002/ · [email protected]https://www.debian.org/security/2019/dsa-4542 · [email protected]https://www.oracle.com/security-alerts/cpuapr2020.html · [email protected]https://www.oracle.com/security-alerts/cpujan2020.html · [email protected]https://www.oracle.com/security-alerts/cpujul2020.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2020.html · [email protected]https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · [email protected]https://access.redhat.com/errata/RHSA-2019:3200 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0159 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0160 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0161 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0164 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0445 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0729 · af854a3a-2127-422b-91ae-364da2661108https://github.com/FasterXML/jackson-databind/issues/2449 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/ · af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2019/Oct/6 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20191004-0002/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2019/dsa-4542 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 SEP 21:45Z
    A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10
    cvelistv5