by Kastro
Paper/Archive/CVE-2019-14893

CVE-2019-14893

Red Hat jackson-databind — A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deseriali…

EPSS 4%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.7.907 × 2018.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Affected

ProductAffectedFixed inSource
jackson-databind2.9.10–CNA
jackson-databind2.10.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryaccess.redhat.com/errata/RHSA-2020:0729reforacle.com/security-alerts/cpujul2020.htmlrefbugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893refgithub.com/FasterXML/jackson-databind/issues/2469refsecurity.netapp.com/advisory/ntap-20200327-0006reflists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ereflists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ereforacle.com/security-alerts/cpuoct2020.html