CoreCVE
Back

CRITICAL

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

Published Oct 12, 2019

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Affected products

Remediation

Red Hat statement

Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release. Red Hat OpenShift Container Platform does ship the vulnerable component, but does not enable the unsafe conditions needed to exploit, lowering their vulnerability impact.

Red Hat mitigation

The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-502

Deserialization of Untrusted Data

References (31)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 12, 2019
Updated Aug 5, 2024
Reserved Oct 12, 2019
Link CVE-2019-17531
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-17531
Red Hat
Severity Important
Public date Oct 12, 2019
Links CVE-2019-17531 - Bugzilla
ENISA EUVD
Assigner mitre
Published Oct 12, 2019
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2019-0750
EUVD-2019-0750 GHSA-GJMW-VF9H-G25V