jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource
Published Oct 1, 2019
9.8
CRITICALCVSS 3.1
EPSS 4.90%
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Affected products
No data.
Configuration 1
- ≥ 2.0.0 · < 2.6.7.3
- ≥ 2.7.0 · < 2.8.11.5
- ≥ 2.9.0 · < 2.9.10.1
Configuration 2
- 8.0
- 9.0
- 10.0
Configuration 3
- 30
- 31
Configuration 4
- 7.2
- 7.3
Running on/with
- 6.0
- 7.0
Configuration 5
- 7.2
- 7.3
Running on/with
- 8.0
Configuration 6
- 2.4.0
- 2.4.1
- 2.5.0
- 2.6.0
- 2.6.1
- 2.6.2
- 2.7.0
- 2.7.1
- 2.9.0
- 7.5.0.23.0
- 12.0.0.3.0
- 8.0.0.2.0
- 8.0.0.3.0
- 1.2.1
- 7.1
- 12.2.1.3.0
- 12.2.1.4.0
- 13.9.4.2.2
- 19.1.0.0.0
- 9.2
- 9.2
- ≥ 17.7 · ≤ 17.12.6
- ≥ 18.8.0 · ≤ 18.8.8
- 16.1
- 16.2
- 19.12.0
- 15.0.3
- 16.0.2
- 16.0.3
- 14.1
- ≤ 2.20.5
- 12.2.0.1
- 18c
- 19c
- 12.2.1.3.0
- 12.2.1.4.0
- 12.2.1.3.0
- 12.2.1.4.0
- 12.2.1.3.0
- 12.2.1.4.0
Configuration 7
- ≥ 7.3
- ≥ 7.3
- ≥ 9.5
- n/a
- n/a
- n/a
- n/a
No data.
EAP-CD 19 Tech Preview
jackson-databind
Fixed · RHSA-2020:2333
Red Hat AMQ Streams 1
jackson-databind
Fixed · RHSA-2020:0939
Red Hat Data Grid 7.3.6
jackson-databind
Fixed · RHSA-2020:2321
Red Hat Decision Manager 7
jackson-databind
Fixed · RHSA-2020:0899
Red Hat Enterprise Linux 8
pki-core:10.6-8020020200326162741.c7c3114f
Fixed · RHSA-2020:1644
Red Hat Enterprise Linux 8
pki-deps:10.6-8020020191204213056.6a468ee4
Fixed · RHSA-2020:1644
Red Hat Fuse 7.7.0
jackson-databind
Fixed · RHSA-2020:3192
Red Hat JBoss EAP 7.2
jackson-databind
Fixed · RHSA-2020:0164
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el6eap
Fixed · RHSA-2020:0159
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el7eap
Fixed · RHSA-2020:0160
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el8eap
Fixed · RHSA-2020:0161
Red Hat Openshift Application Runtimes Vert.x 3.8.3
n/a
Fixed · RHSA-2019:3901
Red Hat Process Automation 7
jackson-databind
Fixed · RHSA-2020:0895
Red Hat Single Sign-On 7.3
jackson-databind
Fixed · RHSA-2020:0445
Text-Only RHOAR
n/a
Fixed · RHSA-2020:2067
Red Hat BPM Suite 6
jackson-databind
Out of support scope
Red Hat JBoss A-MQ 6
jackson-databind
Out of support scope
Red Hat JBoss Data Virtualization 6
jackson-databind
Out of support scope
Red Hat JBoss Fuse 6
jackson-databind
Out of support scope
Red Hat Mobile Application Platform 4
jackson-databind
Out of support scope
Red Hat OpenShift Application Runtimes
jackson-databind
Affected
Red Hat OpenShift Container Platform 3.10
elasticsearch-cloud-kubernetes
Will not fix
Red Hat OpenShift Container Platform 3.10
openshift-elasticsearch-plugin
Will not fix
Red Hat OpenShift Container Platform 3.11
openshift3/ose-logging-elasticsearch5
Will not fix
Red Hat OpenShift Container Platform 3.9
elasticsearch-cloud-kubernetes
Will not fix
Red Hat OpenShift Container Platform 3.9
openshift-elasticsearch-plugin
Will not fix
Red Hat OpenShift Container Platform 4
openshift4/ose-logging-elasticsearch5
Will not fix
Red Hat OpenStack Platform 10 (Newton)
opendaylight
Out of support scope
Red Hat OpenStack Platform 13 (Queens)
opendaylight
Will not fix
Red Hat OpenStack Platform 14 (Rocky)
opendaylight
Will not fix
Red Hat Satellite 6
candlepin
Not affected
Red Hat Software Collections
rh-maven35-jackson-databind
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| EAP-CD 19 Tech Preview | jackson-databind | Fixed | RHSA-2020:2333 |
| Red Hat AMQ Streams 1 | jackson-databind | Fixed | RHSA-2020:0939 |
| Red Hat Data Grid 7.3.6 | jackson-databind | Fixed | RHSA-2020:2321 |
| Red Hat Decision Manager 7 | jackson-databind | Fixed | RHSA-2020:0899 |
| Red Hat Enterprise Linux 8 | pki-core:10.6-8020020200326162741.c7c3114f | Fixed | RHSA-2020:1644 |
| Red Hat Enterprise Linux 8 | pki-deps:10.6-8020020191204213056.6a468ee4 | Fixed | RHSA-2020:1644 |
| Red Hat Fuse 7.7.0 | jackson-databind | Fixed | RHSA-2020:3192 |
| Red Hat JBoss EAP 7.2 | jackson-databind | Fixed | RHSA-2020:0164 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6 | eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el6eap | Fixed | RHSA-2020:0159 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7 | eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el7eap | Fixed | RHSA-2020:0160 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-apache-cxf-0:3.2.11-1.redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-glassfish-jsf-0:2.3.5-6.SP3_redhat_00004.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-hal-console-0:3.0.19-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-hibernate-0:5.3.14-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-hibernate-validator-0:6.0.18-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-annotations-0:2.9.10-1.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-core-0:2.9.10-1.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-databind-0:2.9.10.1-1.redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-dataformats-binary-0:2.9.10-1.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-dataformats-text-0:2.9.10-1.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-jaxrs-providers-0:2.9.10-1.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-modules-base-0:2.9.10-2.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jackson-modules-java8-0:2.9.10-1.redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jberet-0:1.3.5-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jboss-ejb-client-0:4.0.27-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jboss-jsf-api_2.3_spec-0:2.3.5-3.SP2_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jboss-server-migration-0:1.3.1-7.Final_redhat_00007.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-jboss-xnio-base-0:3.7.6-3.SP2_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-netty-0:4.1.42-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-picketlink-bindings-0:2.5.5-21.SP12_redhat_00010.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-undertow-0:2.0.28-2.SP1_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-undertow-jastow-0:2.0.8-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-weld-core-0:3.0.6-3.Final_redhat_00003.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-wildfly-0:7.2.6-5.GA_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-wildfly-http-client-0:1.0.18-2.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8 | eap7-wildfly-transaction-client-0:1.1.8-1.Final_redhat_00001.1.el8eap | Fixed | RHSA-2020:0161 |
| Red Hat Openshift Application Runtimes Vert.x 3.8.3 | n/a | Fixed | RHSA-2019:3901 |
| Red Hat Process Automation 7 | jackson-databind | Fixed | RHSA-2020:0895 |
| Red Hat Single Sign-On 7.3 | jackson-databind | Fixed | RHSA-2020:0445 |
| Text-Only RHOAR | n/a | Fixed | RHSA-2020:2067 |
| Red Hat BPM Suite 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss A-MQ 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Data Virtualization 6 | jackson-databind | Out of support scope | n/a |
| Red Hat JBoss Fuse 6 | jackson-databind | Out of support scope | n/a |
| Red Hat Mobile Application Platform 4 | jackson-databind | Out of support scope | n/a |
| Red Hat OpenShift Application Runtimes | jackson-databind | Affected | n/a |
| Red Hat OpenShift Container Platform 3.10 | elasticsearch-cloud-kubernetes | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.10 | openshift-elasticsearch-plugin | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift3/ose-logging-elasticsearch5 | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.9 | elasticsearch-cloud-kubernetes | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.9 | openshift-elasticsearch-plugin | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-logging-elasticsearch5 | Will not fix | n/a |
| Red Hat OpenStack Platform 10 (Newton) | opendaylight | Out of support scope | n/a |
| Red Hat OpenStack Platform 13 (Queens) | opendaylight | Will not fix | n/a |
| Red Hat OpenStack Platform 14 (Rocky) | opendaylight | Will not fix | n/a |
| Red Hat Satellite 6 | candlepin | Not affected | n/a |
| Red Hat Software Collections | rh-maven35-jackson-databind | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release. Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
Red Hat mitigation
The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
References (45)
- https://access.redhat.com/errata/RHSA-2020:0159 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0160 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0161 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0164 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0445 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2019-16943 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1758191 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0747 Advisory
- https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b
- https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f
- https://github.com/FasterXML/jackson-databind/issues/2478 x_refsource_MISCPatchThird Party Advisory
- https://github.com/advisories/GHSA-fmmc-742q-jg75 Advisory
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd%40%3Ccommits.iceberg.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd@%3Ccommits.iceberg.apache.org%3E
- https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 x_refsource_MISC
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://nvd.nist.gov/vuln/detail/CVE-2019-16943
- https://seclists.org/bugtraq/2019/Oct/6 mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20191017-0006/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-16943
- https://www.debian.org/security/2019/dsa-4542 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISCPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISCPatchThird Party Advisory
Change history (1)
- EUVD
Updated
changed from Aug 5, 2024 to Oct 7, 2026Aug 5, 2024 → Oct 7, 2026
CVE.org / MITRE
CISA Vulnrichment
GitHub