NetSight
IP …
critical9.8

CVE-2019-16942

Polymorphic Typing in FasterXML jackson-databind

Impact

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.10.12.9.10.1

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.8.0 before 2.8.11.5
from 2.9.0 before 2.9.10.1
DebianDebian Linux
Versions 8.0, 9.0, 10.0
FedoraprojectFedora
Versions 30, 31
RedhatJboss Enterprise Application Platform
Versions 7.2.0, 7.3
NetappActive Iq Unified Manager
from 7.3
from 9.5
NetappOncommand Api Services
All versions
NetappOncommand Workflow Automation
All versions
NetappService Level Manager
All versions
NetappSteelstore Cloud Integrated Storage
All versions
OracleBanking Platform
Versions 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleCommunications Billing And Revenue Management
Versions 7.5.0.23.0, 12.0.0.3.0
OracleCommunications Calendar Server
Versions 8.0.0.2.0, 8.0.0.3.0

Weakness classification

CWE-502

References