Bug 1725795 (CVE-2019-12814)
| Summary: | CVE-2019-12814 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | msiddiqu |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahardin, aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, asoldano, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bkearney, bleanhar, bmaxwell, bmontgom, brian.stansberry, btotty, cbyrne, ccoleman, cdewolf, chazlett, cmacedo, darran.lofthouse, dbecker, dedgar, dffrench, dosoudil, drieden, drusso, eparis, etirelli, ggaughan, hhorak, hhudgeon, ibek, iweiss, janstey, java-sig-commits, jawilson, jbalunas, jburrell, jcantril, jgoulding, jjoyce, jmadigan, jochrist, jokerman, jorton, jpallich, jperkins, jschluet, jshepherd, kbasil, krathod, kverlaen, kwills, lef, lgao, lhh, lpeer, lthon, lzap, mburns, mchappel, mhulan, mkolesni, mmccune, mnovotny, msochure, msvehla, mszynkie, ngough, nstielau, nwallace, paradhya, pdrozd, pgallagh, pmackay, psotirop, puntogil, pwright, rchan, rguimara, rhcs-maint, rjerrido, rrajasek, rruss, rsvoboda, rsynek, sclewis, scohen, sdaley, slinaber, smaestri, sponnaga, sthorger, tom.jenkinson, trepel, trogers, twalsh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jackson-databind 2.9.9.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-09-27 00:45:40 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1725796, 1726928, 1726929, 1730588, 1731780, 1731787, 1731789, 1731790, 1731792, 1732286, 1732291, 1732539 | ||
| Bug Blocks: | 1725811 | ||
|
Description
msiddiqu
2019-07-01 13:15:45 UTC
Created jackson-databind tracking bugs for this issue: Affects: fedora-all [bug 1725796] Mitigation: This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application's ClassPath. Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability. OpenDaylight in Red Hat OpenStack 9 & 10 was released as Technical Preview and is not receiving fixes. Statement: * Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. * Red Hat OpenStack's OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.1 Via RHSA-2019:2858 https://access.redhat.com/errata/RHSA-2019:2858 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-12814 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 Via RHSA-2019:2937 https://access.redhat.com/errata/RHSA-2019:2937 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 Via RHSA-2019:2935 https://access.redhat.com/errata/RHSA-2019:2935 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 Via RHSA-2019:2936 https://access.redhat.com/errata/RHSA-2019:2936 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2019:2938 https://access.redhat.com/errata/RHSA-2019:2938 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3 for RHEL 6 Via RHSA-2019:3044 https://access.redhat.com/errata/RHSA-2019:3044 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3 for RHEL 7 Via RHSA-2019:3045 https://access.redhat.com/errata/RHSA-2019:3045 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3 for RHEL 8 Via RHSA-2019:3046 https://access.redhat.com/errata/RHSA-2019:3046 This issue has been addressed in the following products: Red Hat Single Sign-On 7.3.4 zip Via RHSA-2019:3050 https://access.redhat.com/errata/RHSA-2019:3050 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2019:3149 https://access.redhat.com/errata/RHSA-2019:3149 This issue has been addressed in the following products: Red Hat Decision Manager Via RHSA-2019:3292 https://access.redhat.com/errata/RHSA-2019:3292 This issue has been addressed in the following products: Red Hat Process Automation Via RHSA-2019:3297 https://access.redhat.com/errata/RHSA-2019:3297 This issue has been addressed in the following products: Red Hat Fuse 7.6.0 Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983 |