FasterXML jackson-databind is vulnerable to deserialization of untrusted data. It causes polymorphic typing because there are more than one association gadget types related to com.zaxxer.hikari.HikariDataSource by default. This vulnerability is different from CVE-2019-14540. A remote attacker can gain unauthorized access to sensitive information on the system.
access.redhat.com/errata/RHSA-2019:3200
access.redhat.com/errata/RHSA-2020:0159
access.redhat.com/errata/RHSA-2020:0160
access.redhat.com/errata/RHSA-2020:0161
access.redhat.com/errata/RHSA-2020:0164
access.redhat.com/errata/RHSA-2020:0445
access.redhat.com/errata/RHSA-2020:0729
github.com/FasterXML/jackson-databind/issues/2449
github.com/FasterXML/jackson-databind/issues/2449#issue-491794946
lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E
lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@%3Cissues.hbase.apache.org%3E
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@%3Cissues.hbase.apache.org%3E
lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@%3Cissues.hbase.apache.org%3E
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@%3Cissues.hbase.apache.org%3E
lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@%3Ccommits.hbase.apache.org%3E
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
lists.debian.org/debian-lts-announce/2019/10/msg00001.html
lists.fedoraproject.org/archives/list/[email protected]/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
lists.fedoraproject.org/archives/list/[email protected]/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
seclists.org/bugtraq/2019/Oct/6
security.netapp.com/advisory/ntap-20191004-0002/
www.debian.org/security/2019/dsa-4542
www.oracle.com/security-alerts/cpuapr2020.html
www.oracle.com/security-alerts/cpujan2020.html
www.oracle.com/security-alerts/cpujul2020.html
www.oracle.com/security-alerts/cpuoct2020.html
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html