CoreCVE
Back

CRITICAL

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig

Published Sep 15, 2019

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Affected products

Remediation

Red Hat statement

Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.

Red Hat mitigation

This vulnerability relies on com.zaxxer.hikari.HikariConfig being present in the application's ClassPath. Hikari is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use com.zaxxer.hikari are not impacted by this vulnerability. A mitigation to this class of problem in jackson-databind is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

Metrics

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (59)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 15, 2019
Updated Aug 5, 2024
Reserved Aug 2, 2019
Link CVE-2019-14540
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-14540
Red Hat
Severity Moderate
Public date Sep 15, 2019
Links CVE-2019-14540 - Bugzilla
GHSA-H822-R4R5-V8JG