[Bug 1737517] New: CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Bug ID: 1737517 Summary: CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: msiddiqu@redhat.com CC: ahardin@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, asoldano@redhat.com, ataylor@redhat.com, avibelli@redhat.com, bbaranow@redhat.com, bbuckingham@redhat.com, bcourt@redhat.com, bgeorges@redhat.com, bkearney@redhat.com, bleanhar@redhat.com, bmaxwell@redhat.com, brian.stansberry@redhat.com, btotty@redhat.com, cbyrne@redhat.com, ccoleman@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, cmacedo@redhat.com, darran.lofthouse@redhat.com, dbecker@redhat.com, dedgar@redhat.com, dffrench@redhat.com, dosoudil@redhat.com, drieden@redhat.com, drusso@redhat.com, eparis@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, hhorak@redhat.com, hhudgeon@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jbalunas@redhat.com, jgoulding@redhat.com, jjoyce@redhat.com, jkurik@redhat.com, jmadigan@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jorton@redhat.com, jpallich@redhat.com, jperkins@redhat.com, jschatte@redhat.com, jschluet@redhat.com, jshepherd@redhat.com, jstastny@redhat.com, kbasil@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, lef@fedoraproject.org, lgao@redhat.com, lhh@redhat.com, lpeer@redhat.com, lpetrovi@redhat.com, lthon@redhat.com, lzap@redhat.com, mat.booth@redhat.com, mburns@redhat.com, mchappel@redhat.com, mhulan@redhat.com, mkolesni@redhat.com, mmccune@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msvehla@redhat.com, mszynkie@redhat.com, ngough@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pdrozd@redhat.com, pgallagh@redhat.com, pmackay@redhat.com, psotirop@redhat.com, puntogil@libero.it, pwright@redhat.com, rchan@redhat.com, rguimara@redhat.com, rhcs-maint@redhat.com, rjerrido@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rsvoboda@redhat.com, rsynek@redhat.com, sclewis@redhat.com, scohen@redhat.com, sdaley@redhat.com, slinaber@redhat.com, smaestri@redhat.com, sthorger@redhat.com, tbrisker@redhat.com, tom.jenkinson@redhat.com, trepel@redhat.com, trogers@redhat.com, twalsh@redhat.com, vhalbert@redhat.com Target Milestone: --- Classification: Other
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used, leading to remote code execution.
References:
https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9...
Upstream issue:
https://github.com/FasterXML/jackson-databind/issues/2387
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1737518
--- Comment #1 from msiddiqu@redhat.com --- Created jackson-databind tracking bugs for this issue:
Affects: fedora-all [bug 1737518]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1737518 [Bug 1737518] CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1737522
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #6 from Jason Shepherd jshepherd@redhat.com --- Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1738408, 1738409, 1738406, | |1738410, 1738411, 1738407, | |1738404
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1739083, 1739084
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #9 from Cedric Buissart 🐶 cbuissar@redhat.com --- Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.
Similarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #10 from Joshua Padman jpadman@redhat.com --- This vulnerability is out of security support scope for the following product: * Red Hat Mobile Application Platform
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1740589, 1740588, 1740590, | |1740591
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #12 from Stefan Cornelius scorneli@redhat.com --- Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.
Similarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.
This issue affects the versions of jackson-databind as shipped with Red Hat Enterprise Linux 8.
This issue affects the versions of rh-maven35-jackson-databind as shipped with Red Hat Software Collections.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jackson-databind 2.9.9.2, | |jackson-databind 2.10.0, | |jackson-databind 2.7.9.6, | |jackson-databind 2.8.11.4
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #13 from Joshua Padman jpadman@redhat.com --- Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.
Similarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.
Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
This issue affects the versions of jackson-databind as shipped with Red Hat Enterprise Linux 8.
This issue affects the versions of rh-maven35-jackson-databind as shipped with Red Hat Software Collections.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #18 from Joshua Padman jpadman@redhat.com --- Statement:
While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.
Similarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.
Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #23 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS
Via RHSA-2019:2743 https://access.redhat.com/errata/RHSA-2019:2743
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2743
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2019-09-13 12:45:32
--- Comment #24 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-14379
https://bugzilla.redhat.com/show_bug.cgi?id=1737517 Bug 1737517 depends on bug 1737518, which changed state.
Bug 1737518 Summary: CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1737518
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.1
Via RHSA-2019:2858 https://access.redhat.com/errata/RHSA-2019:2858
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2858
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8
Via RHSA-2019:2937 https://access.redhat.com/errata/RHSA-2019:2937
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2937
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
Via RHSA-2019:2935 https://access.redhat.com/errata/RHSA-2019:2935
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2935
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #33 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
Via RHSA-2019:2936 https://access.redhat.com/errata/RHSA-2019:2936
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2936
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #34 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2019:2938 https://access.redhat.com/errata/RHSA-2019:2938
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2938
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Martin Kosek mkosek@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mkosek@redhat.com Flags| |needinfo?(msiddiqu@redhat.c | |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
msiddiqu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |msiddiqu@redhat.com, | |prodsec-dev@redhat.com Flags|needinfo?(msiddiqu@redhat.c |needinfo?(prodsec-dev@redha |om) |t.com)
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #38 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes
Via RHSA-2019:2998 https://access.redhat.com/errata/RHSA-2019:2998
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2998
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Ondrej Soukup osoukup@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |osoukup@redhat.com Flags|needinfo?(prodsec-dev@redha | |t.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #40 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.3 for RHEL 6
Via RHSA-2019:3044 https://access.redhat.com/errata/RHSA-2019:3044
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3044
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #41 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.3 for RHEL 7
Via RHSA-2019:3045 https://access.redhat.com/errata/RHSA-2019:3045
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3045
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #42 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.3 for RHEL 8
Via RHSA-2019:3046 https://access.redhat.com/errata/RHSA-2019:3046
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3046
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #43 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Single Sign-On 7.3.4 zip
Via RHSA-2019:3050 https://access.redhat.com/errata/RHSA-2019:3050
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3050
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #47 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Decision Manager
Via RHSA-2019:3292 https://access.redhat.com/errata/RHSA-2019:3292
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3292
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #48 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2019:3297 https://access.redhat.com/errata/RHSA-2019:3297
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3297
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #49 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes Vert.x 3.8.3
Via RHSA-2019:3901 https://access.redhat.com/errata/RHSA-2019:3901
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3901
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Doc Text *updated* by Jonathan Christison jochrist@redhat.com --- A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #53 from Jonathan Christison jochrist@redhat.com --- Mitigation:
The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #54 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 7.3.3
Via RHSA-2020:0727 https://access.redhat.com/errata/RHSA-2020:0727
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0727
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #55 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.6.0
Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:0983
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1940563
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #57 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via RHSA-2021:1230 https://access.redhat.com/errata/RHSA-2021:1230
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
--- Comment #58 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856
https://bugzilla.redhat.com/show_bug.cgi?id=1737517
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:5856
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com