Описание
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code.
Отчет
Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle jboss-common-core jar. Red Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn't bundle jboss-common-core jar.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | jackson-databind | Not affected | ||
| Red Hat JBoss A-MQ 6 | jackson-databind | Affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | jackson-databind | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | jackson-databind | Affected | ||
| Red Hat JBoss Fuse Integration Service 2 | jackson-databind | Affected | ||
| Red Hat JBoss Operations Network 3 | Core Server | Not affected | ||
| Red Hat Mobile Application Platform 4 | jackson-databind | Not affected | ||
| Red Hat OpenShift Application Runtimes | jackson-databind | Affected | ||
| Red Hat OpenShift Container Platform 3.10 | elasticsearch-cloud-kubernetes | Affected | ||
| Red Hat OpenShift Container Platform 3.10 | openshift-elasticsearch-plugin | Affected |
Показывать по
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to h ...
com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
Уязвимость функции FasterXML Java-библиотеки для грамматического разбора JSON файлов jackson-databind, позволяющая нарушителю оказать воздействие на целостность данных, получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании
7.3 High
CVSS3