CoreCVE
Back

CRITICAL

jackson-databind: Serialization gadgets in anteros-core

Published Mar 2, 2020

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Affected products

Remediation

Red Hat statement

Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release. Red Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.

Metrics

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (32)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 2, 2020
Updated Aug 4, 2024
Reserved Mar 2, 2020
Link CVE-2020-9548
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Aug 25, 2026
Link CVE-2020-9548
Red Hat
Severity Important
Public date Mar 2, 2020
Links CVE-2020-9548 - Bugzilla
GHSA-P43X-XFJF-5JHR