CVE-2019-14893
🟠 Łataj w tym tygodniu
Polimorficzna deserializacja w FasterXML jackson-databind pozwala na zdalne wykonanie kodu.
CVSS
9.8
EPSS
4.1%
Exploit
none
Vendor
fasterxml
Opis źródłowy (NVD)
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
deserialization
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 4.1% |
| Opublikowano (NVD) | 2020-03-02 21:15:17 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 22:16:50 UTC |
Referencje
- https://access.redhat.com/errata/RHSA-2020:0729 ([email protected]) [Third Party Advisory]
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893 ([email protected]) [Issue Tracking, Patch, Third Party Advisory]
- https://github.com/FasterXML/jackson-databind/issues/2469 ([email protected]) [Third Party Advisory]
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E ([email protected])
- https://security.netapp.com/advisory/ntap-20200327-0006/ ([email protected]) [Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujul2020.html ([email protected]) [Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuoct2020.html ([email protected]) [Third Party Advisory]