CoreCVE
Back

CRITICAL

jackson-databind: Serialization gadgets in classes of the ehcache package

Published Oct 6, 2019

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Affected products

Remediation

Red Hat statement

Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. Red Hat OpenShift Container Platform does ship the vulnerable component, but does not enable the unsafe conditions needed to exploit, lowering their vulnerability impact.

Red Hat mitigation

The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (34)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 6, 2019
Updated Oct 7, 2026
Reserved Oct 6, 2019
Link CVE-2019-17267
CISA Vulnrichment
Updated Oct 7, 2026
NVD
Status Modified
Modified Oct 7, 2026
Link CVE-2019-17267
Red Hat
Severity Moderate
Public date Sep 17, 2019
Links CVE-2019-17267 - Bugzilla
ENISA EUVD
Assigner mitre
Published Oct 6, 2019
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2020-0483
EUVD-2020-0483 GHSA-F3J5-RMMP-3FC5