Описание
Уязвимость функции FasterXML Java-библиотеки для грамматического разбора JSON файлов jackson-databind связана с неспособностью заблокировать класс openjpa от полиморфной десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код или вызвать отказ в обслуживании
Вендор
Red Hat Inc.
Сообщество свободного программного обеспечения
Oracle Corp.
FasterXML, LLC
Наименование ПО
Red Hat Enterprise Linux
Debian GNU/Linux
Business Process Management Suite
JD Edwards EnterpriseOne Tools
Primavera Unifier
Primavera P6 Enterprise Project Portfolio Management
WebCenter Portal
Retail Xstore Point of Service
Jackson-databind
OpenShift Container Platform
Communications Billing and Revenue Management
Retail Workforce Management Software
Jboss BRMS
Communications Unified
Primavera Gateway
Enterprise Manager for Virtualization
Retail Customer Management and Segmentation Foundation
Insurance Performance Insight
Insurance Allocation Manager for Enterprise Profitability
Financial Services Retail Customer Analytics
Financial Services Profitability Management
Financial Services Price Creation and Discovery
Financial Services Institutional Performance Analytics
Financial Services Funds Transfer Pricing
Financial Services Analytical Applications Infrastructure
Banking Platform
Jboss Fuse
JBoss A-MQ
OpenShift Application Runtimes
Automation Manager
Версия ПО
7 (Red Hat Enterprise Linux)
9 (Debian GNU/Linux)
12.1.3.0.0 (Business Process Management Suite)
12.2.1.3.0 (Business Process Management Suite)
9.2 (JD Edwards EnterpriseOne Tools)
16.2 (Primavera Unifier)
16.1 (Primavera Unifier)
15.1 (Primavera P6 Enterprise Project Portfolio Management)
15.2 (Primavera P6 Enterprise Project Portfolio Management)
16.1 (Primavera P6 Enterprise Project Portfolio Management)
16.2 (Primavera P6 Enterprise Project Portfolio Management)
18.8 (Primavera P6 Enterprise Project Portfolio Management)
12.2.1.3.0 (WebCenter Portal)
от 17.7 до 17.12 (Primavera P6 Enterprise Project Portfolio Management)
7.0 (Retail Xstore Point of Service)
7.4 EUS (Red Hat Enterprise Linux)
7.5 EUS (Red Hat Enterprise Linux)
7.6 EUS (Red Hat Enterprise Linux)
от 2.0.0 до 2.9.8 (Jackson-databind)
8 (Debian GNU/Linux)
3.11 (OpenShift Container Platform)
7.5 (Communications Billing and Revenue Management)
12.0 (Communications Billing and Revenue Management)
1.60.9.0.0 (Retail Workforce Management Software)
6.4 (Jboss BRMS)
от 17.7 до 17.12 (Primavera Unifier)
18.8 (Primavera Unifier)
8.0.0.2.0 (Communications Unified)
15.2 (Primavera Gateway)
16.2 (Primavera Gateway)
17.12 (Primavera Gateway)
18.8 (Primavera Gateway)
13.1 (Enterprise Manager for Virtualization)
13.2 (Enterprise Manager for Virtualization)
13.3 (Enterprise Manager for Virtualization)
16.0 (Retail Customer Management and Segmentation Foundation)
17.0 (Retail Customer Management and Segmentation Foundation)
18.0 (Retail Customer Management and Segmentation Foundation)
7.1 (Retail Xstore Point of Service)
15.0 (Retail Xstore Point of Service)
16.0 (Retail Xstore Point of Service)
17.0 (Retail Xstore Point of Service)
18.0 (Retail Xstore Point of Service)
8.0.7 (Insurance Performance Insight)
8.0.8 (Insurance Allocation Manager for Enterprise Profitability)
от 8.0.4 до 8.0.6 включительно (Financial Services Retail Customer Analytics)
от 8.0.4 до 8.0.7 включительно (Financial Services Profitability Management)
от 8.0.4 до 8.0.7 включительно (Financial Services Price Creation and Discovery)
от 8.0.4 до 8.0.7 включительно (Financial Services Institutional Performance Analytics)
от 8.0.6 до 8.0.7 включительно (Financial Services Funds Transfer Pricing)
от 8.0.2 до 8.0.8 включительно (Financial Services Analytical Applications Infrastructure)
от 2.4.0 до 2.7.1 включительно (Banking Platform)
6.3 (Jboss Fuse)
7.4 (Jboss BRMS)
6.3 (JBoss A-MQ)
1.0 (OpenShift Application Runtimes)
7.3.1 (Automation Manager)
Тип ПО
Операционная система
Прикладное ПО информационных систем
Сетевое программное средство
Операционные системы и аппаратные платформы
Сообщество свободного программного обеспечения Linux .
Уровень опасности уязвимости
Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Критический уровень опасности (базовая оценка CVSS 3.0 составляет 9,8)
Возможные меры по устранению уязвимости
Использование рекомендаций:
Для jackson-databind:
https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
https://github.com/FasterXML/jackson-databind/issues/2186
Для программных продуктов Oracle Corp.:
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Для Debian GNU/Linux:
https://www.debian.org/security/2019/dsa-4452
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2018-19361
https://bugzilla.redhat.com/show_bug.cgi?id=1666484
Статус уязвимости
Подтверждена производителем
Наличие эксплойта
Данные уточняются
Информация об устранении
Уязвимость устранена
Ссылки на источники
Идентификаторы других систем описаний уязвимостей
- CVE
EPSS
Процентиль: 85%
0.02435
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Связанные уязвимости
CVSS3: 9.8
ubuntu
около 7 лет назад
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVSS3: 7.3
redhat
около 7 лет назад
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVSS3: 9.8
nvd
около 7 лет назад
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVSS3: 9.8
debian
около 7 лет назад
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to h ...
CVSS3: 9.8
github
около 7 лет назад
Deserialization of Untrusted Data in jackson-databind
EPSS
Процентиль: 85%
0.02435
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2