NetSight
IP …
medium5.9

CVE-2019-12384

Deserialization of Untrusted Data in FasterXML jackson-databind

Impact

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.9.12.9.9.1

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.7.0 before 2.7.9.6
from 2.8.0 before 2.8.11.4
from 2.9.0 before 2.9.9.1
DebianDebian Linux
Version 8.0
RedhatEnterprise Linux
Versions 7.0, 7.4, 7.5, 7.6, 7.7

Weakness classification

CWE-502

References