Critical · published March 2, 2020
⚠️ A mishandling in serialization could sideline your app! This vulnerability in fasterXML jackson-databind can arise if you’re using versions before 2.9.10.4 — it’s like a recipe that doesn't follow the right mix of ingredients! 😅 Think of this vulnerability as a restaurant that serves dishes using expired ingredients without checking. Just like you wouldn't want mystery meat in your tacos, you definitely don't want improperly handled data in your app! If an attacker exploits this issue, they could potentially introduce harmful data into your system, leading to unexpected behavior or even crashing your app. While not actively exploited, the risk of improperly serialized data still poses an alarming scenario for your application’s integrity. 🔥
Think of this vulnerability as a restaurant that serves dishes using expired ingredients without checking. Just like you wouldn't want mystery meat in your tacos, you definitely don't want improperly handled data in your app! This vulnerability occurs because jackson-databind mishandles the interaction between serialization gadgets and typing. Specifically, it allows for unsafe object deserialization related to the AnterosDBCPConfig, which could lead to various issues if leveraged by a malicious user.
If an attacker exploits this issue, they could potentially introduce harmful data into your system, leading to unexpected behavior or even crashing your app. While not actively exploited, the risk of improperly serialized data still poses an alarming scenario for your application’s integrity. 🔥 To safeguard your application, upgrade to jackson-databind version 2.9.10.4 or later immediately. Also, review your serialization practices to ensure strict controls on what data can be deserialized. Staying vigilant with updates is key! You've got this! By following these steps, you'll not only fix the issue but become a security hero! 🦸♂️
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.7.9.7 | 2.7.9.7 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.6 | 2.8.11.6 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.10.4 | 2.9.10.4 |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| debian/debian_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/autovue_for_agile_product_lifecycle_management | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_digital_experience | all versions | — |
| oracle/banking_platform | ≥ 2.4.0, ≤ 2.9.0 | — |
| oracle/communications_calendar_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_contacts_server | all versions | — |
| oracle/communications_diameter_signaling_router | ≥ 8.0.0, ≤ 8.2.2 | — |
| oracle/communications_element_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_evolved_communications_application_server | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_network_charging_and_control | ≥ 12.0.0, ≤ 12.0.3 | — |
| oracle/communications_network_charging_and_control | all versions | — |
| oracle/communications_session_report_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/communications_session_route_manager | ≥ 8.2.0, ≤ 8.2.2 | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/global_lifecycle_management_opatch | < 12.2.0.1.20 | 12.2.0.1.20 |
| oracle/jd_edwards_enterpriseone_orchestrator | < 9.2.4.2 | 9.2.4.2 |
| oracle/jd_edwards_enterpriseone_tools | < 9.2.4.2 | 9.2.4.2 |
| oracle/primavera_unifier | ≥ 17.7, ≤ 17.12 | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/primavera_unifier | all versions | — |
| oracle/retail_merchandising_system | all versions | — |
| oracle/retail_sales_audit | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |