https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Bug ID: 1815495 Summary: CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mkaplan@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, ataylor@redhat.com, avibelli@redhat.com, bgeorges@redhat.com, chazlett@redhat.com, decathorpe@gmail.com, dkreling@redhat.com, drieden@redhat.com, etirelli@redhat.com, ganandan@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jbalunas@redhat.com, jochrist@redhat.com, jolee@redhat.com, jpallich@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, lef@fedoraproject.org, lthon@redhat.com, mnovotny@redhat.com, mszynkie@redhat.com, paradhya@redhat.com, pdrozd@redhat.com, pgallagh@redhat.com, pjindal@redhat.com, puntogil@libero.it, rhcs-maint@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rsynek@redhat.com, sdaley@redhat.com, stewardship-sig@lists.fedoraproject.org, sthorger@redhat.com, swoodman@redhat.com, vhalbert@redhat.com Target Milestone: --- Classification: Other
jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory which could result in remote command execution
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #1 from Michael Kaplan mkaplan@redhat.com --- External References:
https://github.com/FasterXML/jackson-databind/issues/2659
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Michael Kaplan mkaplan@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1815496
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1815496 [Bug 1815496] CVE-2020-10672 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #2 from Michael Kaplan mkaplan@redhat.com --- Created jackson-databind tracking bugs for this issue:
Affects: fedora-all [bug 1815496]
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Dhananjay Arunesh darunesh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |Jackson-databind 2.9.10.4 Summary|CVE-2020-10672 |CVE-2020-10672 |jackson-databind: |jackson-databind: |mishandles the interaction |mishandles the interaction |between serialization |between serialization |gadgets and typing which |gadgets and typing which |could result in remote |could result in remote |command execution |command execution
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Michael Kaplan mkaplan@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1815506
https://bugzilla.redhat.com/show_bug.cgi?id=1815495 Bug 1815495 depends on bug 1815496, which changed state.
Bug 1815496 Summary: CVE-2020-10672 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1815496
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |CURRENTRELEASE
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #3 from Jonathan Christison jochrist@redhat.com --- This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse 6 * Red Hat JBoss A-MQ 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #4 from Joshua Padman jpadman@redhat.com --- Statement:
Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1818661, 1818662
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #8 from Ted (Jong Seok) Won jwon@redhat.com --- This vulnerability is out of security support scope for the following product: * Red Hat Enterprise Application Platform 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #16 from Mauro Matteo Cascella mcascell@redhat.com --- Upstream fix: https://github.com/FasterXML/jackson-databind/commit/592872f4235c7f2a3280725...
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(mkaplan@redhat.co | |m)
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1822968, 1822967
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Michael Kaplan mkaplan@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment|1 |updated
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Michael Kaplan mkaplan@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mkaplan@redhat.co | |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #22 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes
Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2067
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2020-05-18 15:15:28
--- Comment #23 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-10672
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
EAP-CD 19 Tech Preview
Via RHSA-2020:2333 https://access.redhat.com/errata/RHSA-2020:2333
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:2333
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment|25 |updated
--- Comment #25 has been edited ---
Adjusted base CVSS score, 7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N -> 8.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H . Adjusted impact correspondingly (which should have been IMPORTANT for base flaw to begin with); set all individual product impacts to their original MODERATE, so no change to product SLAs.
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #26 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.7.0
Via RHSA-2020:3192 https://access.redhat.com/errata/RHSA-2020:3192
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3192
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Decision Manager
Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3196
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3197
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2020:3464 https://access.redhat.com/errata/RHSA-2020:3464
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3464
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6
Via RHSA-2020:3461 https://access.redhat.com/errata/RHSA-2020:3461
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3461
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
Via RHSA-2020:3462 https://access.redhat.com/errata/RHSA-2020:3462
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3462
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #33 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8
Via RHSA-2020:3463 https://access.redhat.com/errata/RHSA-2020:3463
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3463
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #34 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.4.2
Via RHSA-2020:3501 https://access.redhat.com/errata/RHSA-2020:3501
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3501
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #35 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3637
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #36 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3639
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #37 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3638
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #38 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3642
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #39 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 7.3.7
Via RHSA-2020:3779 https://access.redhat.com/errata/RHSA-2020:3779
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3779
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
--- Comment #41 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Via RHSA-2025:1746 https://access.redhat.com/errata/RHSA-2025:1746
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2025:1746
java-sig-commits@lists.fedoraproject.org