Lucene search
Redhat.comRH:CVE-2019-12384HistoryAug 22, 2021 - 1:11 p.m.
CVE-2019-12384
2021-08-2213:11:23
redhat.com
access.redhat.com
29
vulnerability
polymorphic deserialization
malicious objects
logback-core gadget
remote code execution
mitigation advice
EPSS
0.533
Percentile
97.6%
A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. Depending on the classpath content, remote code execution may be possible.
Mitigation
The following conditions are needed for an exploit, we recommend avoiding all if possible:
- Deserialization from sources you do not control
enableDefaultTyping()@JsonTypeInfo usingid.CLASSorid.MINIMAL_CLASS`
Related
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind
2019-07-26 03:24:38
Exploit for Deserialization of Untrusted Data in Fasterxml Jackson-Databind
2019-07-24 07:12:14
ubuntucve
ubuntucve
CVE-2019-12384
2019-06-24 00:00:00
osv
osv
Deserialization of Untrusted Data in FasterXML jackson-databind
2019-07-05 21:07:27
Important: pki-deps:10.6 security update
2019-09-10 15:32:49
Important: pki-deps:10.6 security update
2019-09-10 15:32:49
rocky
rocky
pki-deps:10.6 security update
2019-09-10 15:32:49
redhat
redhat
(RHSA-2019:1820) Important: rh-maven35-jackson-databind security update
2019-07-22 13:08:59
(RHSA-2019:2720) Important: pki-deps:10.6 security update
2019-09-10 15:32:49
(RHSA-2019:3292) Important: Red Hat Decision Manager 7.5.0 Security Update
2019-10-31 17:24:46
oraclelinux
oraclelinux
pki-deps:10.6 security update
2019-09-17 00:00:00
cve
cve
CVE-2019-12384
2019-06-24 16:15:15
github
github
Deserialization of Untrusted Data in FasterXML jackson-databind
2019-07-05 21:07:27
prion
prion
Deserialization of untrusted data
2019-06-24 16:15:00
nessus
nessus
CentOS 8 : pki-deps:10.6 (CESA-2019:2720)
2021-01-29 00:00:00
RHEL 8 : pki-deps:10.6 (RHSA-2019:2720)
2019-09-16 00:00:00
Oracle Linux 8 : pki-deps:10.6 (ELSA-2019-2720)
2023-09-07 00:00:00
almalinux
almalinux
Important: pki-deps:10.6 security update
2019-09-10 15:32:49
nvd
nvd
CVE-2019-12384
2019-06-24 16:15:15
cvelist
cvelist
CVE-2019-12384
2019-06-24 15:34:08
debiancve
debiancve
CVE-2019-12384
2019-06-24 16:15:15
veracode
veracode
Unsafe Deserialization
2019-06-14 03:58:32
debian
debian
[SECURITY] [DLA 1831-1] jackson-databind security update
2019-06-21 15:09:36
[SECURITY] [DSA 4542-1] jackson-databind security update
2019-10-06 08:28:37
[SECURITY] [DSA 4542-1] jackson-databind security update
2019-10-06 08:28:37
ibm
ibm
openvas
openvas
Debian: Security Advisory (DLA-1831-1)
2019-06-22 00:00:00
Fedora Update for jackson-bom FEDORA-2019-fb23eccc03
2019-09-23 00:00:00
Fedora Update for jackson-annotations FEDORA-2019-ae6a703b8f
2019-09-23 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: jackson-databind-2.9.9.3-1.fc30
2019-09-22 02:26:43
[SECURITY] Fedora 31 Update: jackson-bom-2.9.9-1.fc31
2019-09-18 00:07:22
[SECURITY] Fedora 31 Update: jackson-annotations-2.9.9-1.fc31
2019-09-18 00:07:21
mageia
mageia
Updated jackson-databind packages fix security vulnerabilities
2021-03-27 17:27:02
ubuntu
ubuntu
Jackson Databind vulnerabilities
2021-03-15 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - January 2020
2020-01-14 00:00:00
Oracle Critical Patch Update Advisory - July 2020
2020-07-14 00:00:00