Critical · published September 16, 2019
⚠️ A polymorphic typing issue in FasterXML's jackson-databind could lead to unexpected behavior. It's like a chef mistaking salt for sugar in a recipe! 🍳 Think of it as a restaurant where the chef mislabels ingredients, resulting in an unexpected dish that may not be safe for diners with allergies. In the same way, this vulnerability could lead to unexpected behaviors in software depending on the data types it processes. If exploited, this flaw could cause unpredictable results in applications relying on jackson-databind, potentially leading to data corruption or application crashes. While there's no known exploitation yet, the risk of future vulnerabilities arising from these polymorphic typing issues makes it essential to address.
Think of it as a restaurant where the chef mislabels ingredients, resulting in an unexpected dish that may not be safe for diners with allergies. In the same way, this vulnerability could lead to unexpected behaviors in software depending on the data types it processes. The polymorphic typing vulnerability in jackson-databind prior to version 2.9.10 arises from improper handling of certain data types, which could allow an attacker to manipulate data in ways the application doesn't expect, leading to unpredictable behavior.
If exploited, this flaw could cause unpredictable results in applications relying on jackson-databind, potentially leading to data corruption or application crashes. While there's no known exploitation yet, the risk of future vulnerabilities arising from these polymorphic typing issues makes it essential to address. Upgrade jackson-databind to version 2.9.10 or later to mitigate this issue. Additionally, review your application's usage of data binding to ensure all data types are properly validated and handled. Don't wait—better to be safe than sorry! You've got this! By addressing this vulnerability promptly, you're keeping your applications secure and user trust intact! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.8.11.5 | 2.8.11.5 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10 | 2.9.10 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/oncommand_api_services | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/steelstore_cloud_integrated_storage | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/customer_management_and_segmentation_foundation | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.2, ≤ 8.0.8 | — |
| oracle/global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle/global_lifecycle_management_opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle/global_lifecycle_management_opatch | ≥ 13.9.4.0.0, < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle/goldengate_application_adapters | all versions | — |
| oracle/goldengate_stream_analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle/primavera_gateway | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/retail_customer_management_and_segmentation_foundation | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/weblogic_server | all versions | — |