CoreCVE
Back

CRITICAL

jackson-databind: Serialization gadgets in classes of the commons-configuration package

Published Mar 2, 2020

Description

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Affected products

Remediation

Red Hat statement

Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release. Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-502

Deserialization of Untrusted Data

References (15)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 2, 2020
Updated Aug 5, 2024
Reserved Aug 10, 2019
Link CVE-2019-14892
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-14892
Red Hat
Severity Moderate
Public date Sep 19, 2019
Links CVE-2019-14892 - Bugzilla
GHSA-CF6R-3WGC-H863