Back

CRITICAL

jackson-databind: lacks certain net.sf.ehcache blocking

Published Jan 3, 2020

Description

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Affected products

Remediation

Red Hat statement

While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.

Red Hat mitigation

The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

Metrics

References (65)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jan 3, 2020
Updated Aug 5, 2024
Reserved Jan 3, 2020
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Important
Public date Jan 2, 2020
GHSA-GWW7-P5W4-WRFV