Bug 1815470 (CVE-2020-10673)
| Summary: | CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Michael Kaplan <mkaplan> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, asoldano, atangrin, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bmontgom, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dbecker, decathorpe, dkreling, dosoudil, drieden, eparis, etirelli, ganandan, ggaughan, gmalinko, hhorak, ibek, iweiss, janstey, java-maint, java-sig-commits, jawilson, jbalunas, jburrell, jcantril, jjoyce, jochrist, jokerman, jolee, jorton, jpallich, jperkins, jschatte, jschluet, jstastny, jwon, kbasil, krathod, kverlaen, kwills, lef, lgao, lhh, lpeer, lthon, mburns, mkolesni, mnovotny, msochure, msvehla, mszynkie, nstielau, nwallace, paradhya, pdrozd, pgallagh, pjindal, pmackay, psotirop, puntogil, rguimara, rhcs-maint, rrajasek, rruss, rsvoboda, rsynek, sclewis, scohen, sdaley, slinaber, smaestri, sponnaga, stewardship-sig, sthorger, swoodman, tom.jenkinson, vhalbert |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Jackson-databind 2.9.10.4 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-05-18 15:15:21 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1815490, 1818661, 1818662, 1822972, 1822973 | ||
| Bug Blocks: | 1815506 | ||
|
Description
Michael Kaplan
2020-03-20 11:43:21 UTC
Created jackson-databind tracking bugs for this issue: Affects: fedora-all [bug 1815490] Upstream issue: https://github.com/FasterXML/jackson-databind/issues/2660 This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse 6 * Red Hat JBoss A-MQ Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. Statement: Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. Additionally, the gadget is not available within Red Hat Openstack Platform's OpenDaylight. While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release. Upstream fix: https://github.com/FasterXML/jackson-databind/commit/1645efbd392989cf015f459a91c999e59c921b15 This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10673 This issue has been addressed in the following products: Red Hat Fuse 7.7.0 Via RHSA-2020:3192 https://access.redhat.com/errata/RHSA-2020:3192 This issue has been addressed in the following products: Red Hat Decision Manager Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196 This issue has been addressed in the following products: Red Hat Process Automation Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:3464 https://access.redhat.com/errata/RHSA-2020:3464 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Via RHSA-2020:3461 https://access.redhat.com/errata/RHSA-2020:3461 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Via RHSA-2020:3462 https://access.redhat.com/errata/RHSA-2020:3462 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:3463 https://access.redhat.com/errata/RHSA-2020:3463 This issue has been addressed in the following products: Red Hat Single Sign-On 7.4.2 Via RHSA-2020:3501 https://access.redhat.com/errata/RHSA-2020:3501 This issue has been addressed in the following products: EAP-CD 20 Tech Preview Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642 This issue has been addressed in the following products: Red Hat Data Grid 7.3.7 Via RHSA-2020:3779 https://access.redhat.com/errata/RHSA-2020:3779 |