https://bugzilla.redhat.com/show_bug.cgi?id=1725807

msiddiqu@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1725808

--- Comment #1 from msiddiqu@redhat.com --- Created jackson-databind tracking bugs for this issue:

Affects: fedora-all [bug 1725808]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1725808 [Bug 1725808] CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Doran Moppert dmoppert@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jackson-databind 2.9.9.1 Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=9.8/CVSS:3.0/ |rce=cve,cvss3=9.8/CVSS:3.0/ |AV:N/AC:L/PR:N/UI:N/S:U/C:H |AV:N/AC:L/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=new,openstack-8/opendayli |d=new,openstack-8/opendayli |ght=new,openstack-9/openday |ght=new,openstack-9/openday |light=new,openstack-10/open |light=new,openstack-10/open |daylight=new,openstack-13/o |daylight=new,openstack-13/o |pendaylight=new,openstack-1 |pendaylight=new,openstack-1 |4/opendaylight=new,rhsso-7/ |4/opendaylight=new,rhsso-7/ |jackson-databind=new,vertx- |jackson-databind=new,vertx- |3/jackson-databind=new,swar |3/jackson-databind=new,swar |m-7/jackson-databind=new,rh |m-7/jackson-databind=new,rh |el-8/pki-deps:10.6/jackson- |el-8/pki-deps:10.6/jackson- |databind=new,rhn_satellite_ |databind=affected,rhn_satel |6/jackson-databind=new,rhsc |lite_6/jackson-databind=aff |l-3/rh-maven35-jackson-data |ected,rhscl-3/rh-maven35-ja |bind=new,rhdm-7/jackson-dat |ckson-databind=affected,rhd |abind=new,rhpam-7/jackson-d |m-7/jackson-databind=new,rh |atabind=new,fuse-6/jackson- |pam-7/jackson-databind=new, |databind=new,fuse-7/jackson |fuse-6/jackson-databind=new |-databind=new,eap-7/jackson |,fuse-7/jackson-databind=ne |-databind=new,rhmap-4/jacks |w,eap-7/jackson-databind=ne |on-databind=new,openshift-e |w,rhmap-4/jackson-databind= |nterprise-3/ose-logging-ela |new,openshift-enterprise-3/ |sticsearch5=new |ose-logging-elasticsearch5= | |new

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Doran Moppert dmoppert@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1726921, 1726922, 1726923, | |1726925, 1726926, 1726924

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Joshua Padman jpadman@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=9.8/CVSS:3.0/ |rce=cve,cvss3=9.8/CVSS:3.0/ |AV:N/AC:L/PR:N/UI:N/S:U/C:H |AV:N/AC:L/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=new,openstack-8/opendayli |d=new,openstack-9/opendayli |ght=new,openstack-9/openday |ght=new,openstack-10/openda |light=new,openstack-10/open |ylight=new,openstack-13/ope |daylight=new,openstack-13/o |ndaylight=new,openstack-14/ |pendaylight=new,openstack-1 |opendaylight=new,rhsso-7/ja |4/opendaylight=new,rhsso-7/ |ckson-databind=new,vertx-3/ |jackson-databind=new,vertx- |jackson-databind=new,swarm- |3/jackson-databind=new,swar |7/jackson-databind=new,rhel |m-7/jackson-databind=new,rh |-8/pki-deps:10.6/jackson-da |el-8/pki-deps:10.6/jackson- |tabind=affected,rhn_satelli |databind=affected,rhn_satel |te_6/jackson-databind=affec |lite_6/jackson-databind=aff |ted,rhscl-3/rh-maven35-jack |ected,rhscl-3/rh-maven35-ja |son-databind=affected,rhdm- |ckson-databind=affected,rhd |7/jackson-databind=new,rhpa |m-7/jackson-databind=new,rh |m-7/jackson-databind=new,fu |pam-7/jackson-databind=new, |se-6/jackson-databind=new,f |fuse-6/jackson-databind=new |use-7/jackson-databind=new, |,fuse-7/jackson-databind=ne |eap-7/jackson-databind=new, |w,eap-7/jackson-databind=ne |rhmap-4/jackson-databind=ne |w,rhmap-4/jackson-databind= |w,openshift-enterprise-3.11 |new,openshift-enterprise-3. |/ose-logging-elasticsearch5 |11/ose-logging-elasticsearc |=new |h5=new |

--- Comment #4 from Joshua Padman jpadman@redhat.com --- OpenDaylight in Red Hat OpenStack 9 & 10 was released as Technical Preview and is not receiving fixes.

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=9.8/CVSS:3.0/ |rce=cve,cvss3=9.8/CVSS:3.0/ |AV:N/AC:L/PR:N/UI:N/S:U/C:H |AV:N/AC:L/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=new,openstack-10/o |daylight=new,openstack-10/o |pendaylight=new,openstack-1 |pendaylight=new,openstack-1 |3/opendaylight=new,openstac |3/opendaylight=new,openstac |k-14/opendaylight=new,rhsso |k-14/opendaylight=new,rhsso |-7/jackson-databind=notaffe |-7/jackson-databind=notaffe |cted,vertx-3/jackson-databi |cted,vertx-3/jackson-databi |nd=new,swarm-7/jackson-data |nd=new,swarm-7/jackson-data |bind=new,rhel-8/pki-deps:10 |bind=new,rhel-8/pki-deps:10 |.6/jackson-databind=affecte |.6/jackson-databind=affecte |d,rhn_satellite_6/jackson-d |d,rhn_satellite_6/jackson-d |atabind=affected,rhscl-3/rh |atabind=affected,rhscl-3/rh |-maven35-jackson-databind=a |-maven35-jackson-databind=a |ffected,rhdm-7/jackson-data |ffected,rhdm-7/jackson-data |bind=affected,rhpam-7/jacks |bind=affected,rhpam-7/jacks |on-databind=affected,fuse-6 |on-databind=affected,fuse-6 |/jackson-databind=affected, |/jackson-databind=affected, |fuse-7/jackson-databind=aff |fuse-7/jackson-databind=aff |ected,eap-7/jackson-databin |ected,eap-7/jackson-databin |d=new,rhmap-4/jackson-datab |d=new,rhmap-4/jackson-datab |ind=notaffected,openshift-e |ind=notaffected,openshift-e |nterprise-3.11/ose-logging- |nterprise-3.11/ose-logging- |elasticsearch5=new |elasticsearch5=new,openshif | |t-enterprise-3.10/elasticse | |arch-cloud-kubernetes=new,o | |penshift-enterprise-3.9/ela | |sticsearch-cloud-kubernetes | |=new,openshift-enterprise-3 | |.7/elasticsearch-cloud-kube | |rnetes=new,openshift-enterp | |rise-3.6/elasticsearch-clou | |d-kubernetes=new,openshift- | |enterprise-3.10/openshift-e | |lasticsearch-plugin=new,ope | |nshift-enterprise-3.9/opens | |hift-elasticsearch-plugin=n | |ew,openshift-enterprise-3.7 | |/openshift-elasticsearch-pl | |ugin=new,openshift-enterpri | |se-3.6/openshift-elasticsea | |rch-plugin=new

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #8 from Joshua Padman jpadman@redhat.com --- Statement:

OpenDaylight provided as part of Red Hat OpenStack does not utilize logback when used in a supported configuration. Therefore, the prerequisites for this vulnerability are not present and OpenDaylight is not affected.

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Kunjan Rathod krathod@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=9.8/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:L/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/ose-log |ift-enterprise-3.11/ose-log |ging-elasticsearch5=new,ope |ging-elasticsearch5=new,ope |nshift-enterprise-3.10/elas |nshift-enterprise-3.10/elas |ticsearch-cloud-kubernetes= |ticsearch-cloud-kubernetes= |new,openshift-enterprise-3. |new,openshift-enterprise-3. |9/elasticsearch-cloud-kuber |9/elasticsearch-cloud-kuber |netes=new,openshift-enterpr |netes=new,openshift-enterpr |ise-3.7/elasticsearch-cloud |ise-3.7/elasticsearch-cloud |-kubernetes=new,openshift-e |-kubernetes=new,openshift-e |nterprise-3.6/elasticsearch |nterprise-3.6/elasticsearch |-cloud-kubernetes=new,opens |-cloud-kubernetes=new,opens |hift-enterprise-3.10/opensh |hift-enterprise-3.10/opensh |ift-elasticsearch-plugin=ne |ift-elasticsearch-plugin=ne |w,openshift-enterprise-3.9/ |w,openshift-enterprise-3.9/ |openshift-elasticsearch-plu |openshift-elasticsearch-plu |gin=new,openshift-enterpris |gin=new,openshift-enterpris |e-3.7/openshift-elasticsear |e-3.7/openshift-elasticsear |ch-plugin=new,openshift-ent |ch-plugin=new,openshift-ent |erprise-3.6/openshift-elast |erprise-3.6/openshift-elast |icsearch-plugin=new |icsearch-plugin=new

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/ose-log |ift-enterprise-3.11/logging |ging-elasticsearch5=new,ope |-elasticsearch5-container=n |nshift-enterprise-3.10/elas |ew,openshift-enterprise-3.1 |ticsearch-cloud-kubernetes= |0/elasticsearch-cloud-kuber |new,openshift-enterprise-3. |netes=new,openshift-enterpr |9/elasticsearch-cloud-kuber |ise-3.9/elasticsearch-cloud |netes=new,openshift-enterpr |-kubernetes=new,openshift-e |ise-3.7/elasticsearch-cloud |nterprise-3.7/elasticsearch |-kubernetes=new,openshift-e |-cloud-kubernetes=new,opens |nterprise-3.6/elasticsearch |hift-enterprise-3.6/elastic |-cloud-kubernetes=new,opens |search-cloud-kubernetes=new |hift-enterprise-3.10/opensh |,openshift-enterprise-3.10/ |ift-elasticsearch-plugin=ne |openshift-elasticsearch-plu |w,openshift-enterprise-3.9/ |gin=new,openshift-enterpris |openshift-elasticsearch-plu |e-3.9/openshift-elasticsear |gin=new,openshift-enterpris |ch-plugin=new,openshift-ent |e-3.7/openshift-elasticsear |erprise-3.7/openshift-elast |ch-plugin=new,openshift-ent |icsearch-plugin=new,openshi |erprise-3.6/openshift-elast |ft-enterprise-3.6/openshift |icsearch-plugin=new |-elasticsearch-plugin=new

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=n |-elasticsearch5-container=n |ew,openshift-enterprise-3.1 |ew,openshift-enterprise-3.1 |0/elasticsearch-cloud-kuber |0/elasticsearch-cloud-kuber |netes=new,openshift-enterpr |netes=new,openshift-enterpr |ise-3.9/elasticsearch-cloud |ise-3.9/elasticsearch-cloud |-kubernetes=new,openshift-e |-kubernetes=new,openshift-e |nterprise-3.7/elasticsearch |nterprise-3.7/elasticsearch |-cloud-kubernetes=new,opens |-cloud-kubernetes=new,opens |hift-enterprise-3.6/elastic |hift-enterprise-3.6/elastic |search-cloud-kubernetes=new |search-cloud-kubernetes=new |,openshift-enterprise-3.10/ |,openshift-enterprise-3.10/ |openshift-elasticsearch-plu |openshift-elasticsearch-plu |gin=new,openshift-enterpris |gin=new,openshift-enterpris |e-3.9/openshift-elasticsear |e-3.9/openshift-elasticsear |ch-plugin=new,openshift-ent |ch-plugin=new,openshift-ent |erprise-3.7/openshift-elast |erprise-3.7/openshift-elast |icsearch-plugin=new,openshi |icsearch-plugin=new,openshi |ft-enterprise-3.6/openshift |ft-enterprise-3.6/openshift |-elasticsearch-plugin=new,o |-elasticsearch-plugin=new,o |penshift-enterprise-4.1/log |penshift-enterprise-4.1/log |ging-elasticsearch5-contain |ging-elasticsearch5-contain |er=new |er=affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=n |-elasticsearch5-container=a |ew,openshift-enterprise-3.1 |ffected,openshift-enterpris |0/elasticsearch-cloud-kuber |e-3.10/elasticsearch-cloud- |netes=new,openshift-enterpr |kubernetes=new,openshift-en |ise-3.9/elasticsearch-cloud |terprise-3.9/elasticsearch- |-kubernetes=new,openshift-e |cloud-kubernetes=new,opensh |nterprise-3.7/elasticsearch |ift-enterprise-3.7/elastics |-cloud-kubernetes=new,opens |earch-cloud-kubernetes=new, |hift-enterprise-3.6/elastic |openshift-enterprise-3.6/el |search-cloud-kubernetes=new |asticsearch-cloud-kubernete |,openshift-enterprise-3.10/ |s=new,openshift-enterprise- |openshift-elasticsearch-plu |3.10/openshift-elasticsearc |gin=new,openshift-enterpris |h-plugin=new,openshift-ente |e-3.9/openshift-elasticsear |rprise-3.9/openshift-elasti |ch-plugin=new,openshift-ent |csearch-plugin=new,openshif |erprise-3.7/openshift-elast |t-enterprise-3.7/openshift- |icsearch-plugin=new,openshi |elasticsearch-plugin=new,op |ft-enterprise-3.6/openshift |enshift-enterprise-3.6/open |-elasticsearch-plugin=new,o |shift-elasticsearch-plugin= |penshift-enterprise-4.1/log |new,openshift-enterprise-4. |ging-elasticsearch5-contain |1/logging-elasticsearch5-co |er=affected |ntainer=affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=a |-elasticsearch5-container=a |ffected,openshift-enterpris |ffected,openshift-enterpris |e-3.10/elasticsearch-cloud- |e-3.10/elasticsearch-cloud- |kubernetes=new,openshift-en |kubernetes=new,openshift-en |terprise-3.9/elasticsearch- |terprise-3.9/elasticsearch- |cloud-kubernetes=new,opensh |cloud-kubernetes=new,opensh |ift-enterprise-3.7/elastics |ift-enterprise-3.7/elastics |earch-cloud-kubernetes=new, |earch-cloud-kubernetes=new, |openshift-enterprise-3.6/el |openshift-enterprise-3.6/el |asticsearch-cloud-kubernete |asticsearch-cloud-kubernete |s=new,openshift-enterprise- |s=new,openshift-enterprise- |3.10/openshift-elasticsearc |3.10/openshift-elasticsearc |h-plugin=new,openshift-ente |h-plugin=affected,openshift |rprise-3.9/openshift-elasti |-enterprise-3.9/openshift-e |csearch-plugin=new,openshif |lasticsearch-plugin=new,ope |t-enterprise-3.7/openshift- |nshift-enterprise-3.7/opens |elasticsearch-plugin=new,op |hift-elasticsearch-plugin=n |enshift-enterprise-3.6/open |ew,openshift-enterprise-3.6 |shift-elasticsearch-plugin= |/openshift-elasticsearch-pl |new,openshift-enterprise-4. |ugin=new,openshift-enterpri |1/logging-elasticsearch5-co |se-4.1/logging-elasticsearc |ntainer=affected |h5-container=affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=a |-elasticsearch5-container=a |ffected,openshift-enterpris |ffected,openshift-enterpris |e-3.10/elasticsearch-cloud- |e-3.10/elasticsearch-cloud- |kubernetes=new,openshift-en |kubernetes=new,openshift-en |terprise-3.9/elasticsearch- |terprise-3.9/elasticsearch- |cloud-kubernetes=new,opensh |cloud-kubernetes=new,opensh |ift-enterprise-3.7/elastics |ift-enterprise-3.7/elastics |earch-cloud-kubernetes=new, |earch-cloud-kubernetes=new, |openshift-enterprise-3.6/el |openshift-enterprise-3.6/el |asticsearch-cloud-kubernete |asticsearch-cloud-kubernete |s=new,openshift-enterprise- |s=new,openshift-enterprise- |3.10/openshift-elasticsearc |3.10/openshift-elasticsearc |h-plugin=affected,openshift |h-plugin=affected,openshift |-enterprise-3.9/openshift-e |-enterprise-3.9/openshift-e |lasticsearch-plugin=new,ope |lasticsearch-plugin=affecte |nshift-enterprise-3.7/opens |d,openshift-enterprise-3.7/ |hift-elasticsearch-plugin=n |openshift-elasticsearch-plu |ew,openshift-enterprise-3.6 |gin=new,openshift-enterpris |/openshift-elasticsearch-pl |e-3.6/openshift-elasticsear |ugin=new,openshift-enterpri |ch-plugin=new,openshift-ent |se-4.1/logging-elasticsearc |erprise-4.1/logging-elastic |h5-container=affected |search5-container=affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=a |-elasticsearch5-container=a |ffected,openshift-enterpris |ffected,openshift-enterpris |e-3.10/elasticsearch-cloud- |e-3.10/elasticsearch-cloud- |kubernetes=new,openshift-en |kubernetes=new,openshift-en |terprise-3.9/elasticsearch- |terprise-3.9/elasticsearch- |cloud-kubernetes=new,opensh |cloud-kubernetes=new,opensh |ift-enterprise-3.7/elastics |ift-enterprise-3.7/elastics |earch-cloud-kubernetes=new, |earch-cloud-kubernetes=new, |openshift-enterprise-3.6/el |openshift-enterprise-3.6/el |asticsearch-cloud-kubernete |asticsearch-cloud-kubernete |s=new,openshift-enterprise- |s=new,openshift-enterprise- |3.10/openshift-elasticsearc |3.10/openshift-elasticsearc |h-plugin=affected,openshift |h-plugin=affected,openshift |-enterprise-3.9/openshift-e |-enterprise-3.9/openshift-e |lasticsearch-plugin=affecte |lasticsearch-plugin=affecte |d,openshift-enterprise-3.7/ |d,openshift-enterprise-3.7/ |openshift-elasticsearch-plu |openshift-elasticsearch-plu |gin=new,openshift-enterpris |gin=affected,openshift-ente |e-3.6/openshift-elasticsear |rprise-3.6/openshift-elasti |ch-plugin=new,openshift-ent |csearch-plugin=new,openshif |erprise-4.1/logging-elastic |t-enterprise-4.1/logging-el |search5-container=affected |asticsearch5-container=affe | |cted

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=a |-elasticsearch5-container=a |ffected,openshift-enterpris |ffected,openshift-enterpris |e-3.10/elasticsearch-cloud- |e-3.10/elasticsearch-cloud- |kubernetes=new,openshift-en |kubernetes=new,openshift-en |terprise-3.9/elasticsearch- |terprise-3.9/elasticsearch- |cloud-kubernetes=new,opensh |cloud-kubernetes=new,opensh |ift-enterprise-3.7/elastics |ift-enterprise-3.7/elastics |earch-cloud-kubernetes=new, |earch-cloud-kubernetes=new, |openshift-enterprise-3.6/el |openshift-enterprise-3.6/el |asticsearch-cloud-kubernete |asticsearch-cloud-kubernete |s=new,openshift-enterprise- |s=new,openshift-enterprise- |3.10/openshift-elasticsearc |3.10/openshift-elasticsearc |h-plugin=affected,openshift |h-plugin=affected,openshift |-enterprise-3.9/openshift-e |-enterprise-3.9/openshift-e |lasticsearch-plugin=affecte |lasticsearch-plugin=affecte |d,openshift-enterprise-3.7/ |d,openshift-enterprise-3.7/ |openshift-elasticsearch-plu |openshift-elasticsearch-plu |gin=affected,openshift-ente |gin=affected,openshift-ente |rprise-3.6/openshift-elasti |rprise-3.6/openshift-elasti |csearch-plugin=new,openshif |csearch-plugin=affected,ope |t-enterprise-4.1/logging-el |nshift-enterprise-4.1/loggi |asticsearch5-container=affe |ng-elasticsearch5-container |cted |=affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1820 https://access.redhat.com/errata/RHSA-2019:1820

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Product Security DevOps Team prodsec-dev@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2019-07-22 15:07:18

--- Comment #18 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-12384

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected,rhscl |-3/rh-maven35-jackson-datab |-3/rh-maven35-jackson-datab |ind=affected,rhdm-7/jackson |ind=affected,rhdm-7/jackson |-databind=affected,rhpam-7/ |-databind=affected,rhpam-7/ |jackson-databind=affected,f |jackson-databind=affected,f |use-6/jackson-databind=affe |use-6/jackson-databind=affe |cted,fuse-7/jackson-databin |cted,fuse-7/jackson-databin |d=affected,eap-7/jackson-da |d=affected,eap-7/jackson-da |tabind=new,rhmap-4/jackson- |tabind=new,rhmap-4/jackson- |databind=notaffected,opensh |databind=notaffected,opensh |ift-enterprise-3.11/logging |ift-enterprise-3.11/logging |-elasticsearch5-container=a |-elasticsearch5-container=a |ffected,openshift-enterpris |ffected,openshift-enterpris |e-3.10/elasticsearch-cloud- |e-3.10/elasticsearch-cloud- |kubernetes=new,openshift-en |kubernetes=new,openshift-en |terprise-3.9/elasticsearch- |terprise-3.9/elasticsearch- |cloud-kubernetes=new,opensh |cloud-kubernetes=affected,o |ift-enterprise-3.7/elastics |penshift-enterprise-3.7/ela |earch-cloud-kubernetes=new, |sticsearch-cloud-kubernetes |openshift-enterprise-3.6/el |=new,openshift-enterprise-3 |asticsearch-cloud-kubernete |.6/elasticsearch-cloud-kube |s=new,openshift-enterprise- |rnetes=new,openshift-enterp |3.10/openshift-elasticsearc |rise-3.10/openshift-elastic |h-plugin=affected,openshift |search-plugin=affected,open |-enterprise-3.9/openshift-e |shift-enterprise-3.9/opensh |lasticsearch-plugin=affecte |ift-elasticsearch-plugin=af |d,openshift-enterprise-3.7/ |fected,openshift-enterprise |openshift-elasticsearch-plu |-3.7/openshift-elasticsearc |gin=wontfix,openshift-enter |h-plugin=wontfix,openshift- |prise-3.6/openshift-elastic |enterprise-3.6/openshift-el |search-plugin=wontfix,opens |asticsearch-plugin=wontfix, |hift-enterprise-4.1/logging |openshift-enterprise-4.1/lo |-elasticsearch5-container=a |gging-elasticsearch5-contai |ffected |ner=affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1732286

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Jeff Cantrill jcantril@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1732539

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Doran Moppert dmoppert@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected,rhscl |son-databind=affected/impac |-3/rh-maven35-jackson-datab |t=low,rhscl-3/rh-maven35-ja |ind=affected,rhdm-7/jackson |ckson-databind=affected,rhd |-databind=affected,rhpam-7/ |m-7/jackson-databind=affect |jackson-databind=affected,f |ed,rhpam-7/jackson-databind |use-6/jackson-databind=affe |=affected,fuse-6/jackson-da |cted,fuse-7/jackson-databin |tabind=affected,fuse-7/jack |d=affected,eap-7/jackson-da |son-databind=affected,eap-7 |tabind=new,rhmap-4/jackson- |/jackson-databind=new,rhmap |databind=notaffected,opensh |-4/jackson-databind=notaffe |ift-enterprise-3.11/logging |cted,openshift-enterprise-3 |-elasticsearch5-container=a |.11/logging-elasticsearch5- |ffected,openshift-enterpris |container=affected,openshif |e-3.10/elasticsearch-cloud- |t-enterprise-3.10/elasticse |kubernetes=affected,openshi |arch-cloud-kubernetes=affec |ft-enterprise-3.9/elasticse |ted,openshift-enterprise-3. |arch-cloud-kubernetes=affec |9/elasticsearch-cloud-kuber |ted,openshift-enterprise-3. |netes=affected,openshift-en |7/elasticsearch-cloud-kuber |terprise-3.7/elasticsearch- |netes=new,openshift-enterpr |cloud-kubernetes=new,opensh |ise-3.6/elasticsearch-cloud |ift-enterprise-3.6/elastics |-kubernetes=new,openshift-e |earch-cloud-kubernetes=new, |nterprise-3.10/openshift-el |openshift-enterprise-3.10/o |asticsearch-plugin=affected |penshift-elasticsearch-plug |,openshift-enterprise-3.9/o |in=affected,openshift-enter |penshift-elasticsearch-plug |prise-3.9/openshift-elastic |in=affected,openshift-enter |search-plugin=affected,open |prise-3.7/openshift-elastic |shift-enterprise-3.7/opensh |search-plugin=wontfix,opens |ift-elasticsearch-plugin=wo |hift-enterprise-3.6/openshi |ntfix,openshift-enterprise- |ft-elasticsearch-plugin=won |3.6/openshift-elasticsearch |tfix,openshift-enterprise-4 |-plugin=wontfix,openshift-e |.1/logging-elasticsearch5-c |nterprise-4.1/logging-elast |ontainer=affected,openshift |icsearch5-container=affecte |-4.2/logging-elasticsearch5 |d,openshift-4.2/logging-ela |-container=affected |sticsearch5-container=affec | |ted

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

Kunjan Rathod krathod@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |90621,reported=20190625,sou |90621,reported=20190625,sou |rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/ |AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H |/I:H/A:H,cwe=CWE-502,fedora |/I:H/A:H,cwe=CWE-502,fedora |-all/jackson-databind=affec |-all/jackson-databind=affec |ted,amq-6/jackson-databind= |ted,amq-6/jackson-databind= |new,amq-st/jackson-databind |new,amq-st/jackson-databind |=new,bpms-6/jackson-databin |=new,bpms-6/jackson-databin |d=affected,openstack-9/open |d=affected,openstack-9/open |daylight=notaffected,openst |daylight=notaffected,openst |ack-10/opendaylight=notaffe |ack-10/opendaylight=notaffe |cted,openstack-13/opendayli |cted,openstack-13/opendayli |ght=notaffected,openstack-1 |ght=notaffected,openstack-1 |4/opendaylight=notaffected, |4/opendaylight=notaffected, |rhsso-7/jackson-databind=no |rhsso-7/jackson-databind=no |taffected,vertx-3/jackson-d |taffected,vertx-3/jackson-d |atabind=new,swarm-7/jackson |atabind=new,swarm-7/jackson |-databind=new,rhel-8/pki-de |-databind=new,rhel-8/pki-de |ps:10.6/jackson-databind=af |ps:10.6/jackson-databind=af |fected,rhn_satellite_6/jack |fected,rhn_satellite_6/jack |son-databind=affected/impac |son-databind=affected/impac |t=low,rhscl-3/rh-maven35-ja |t=low,rhscl-3/rh-maven35-ja |ckson-databind=affected,rhd |ckson-databind=affected,rhd |m-7/jackson-databind=affect |m-7/jackson-databind=affect |ed,rhpam-7/jackson-databind |ed,rhpam-7/jackson-databind |=affected,fuse-6/jackson-da |=affected,fuse-6/jackson-da |tabind=affected,fuse-7/jack |tabind=affected,fuse-7/jack |son-databind=affected,eap-7 |son-databind=affected,eap-7 |/jackson-databind=new,rhmap |/jackson-databind=affected, |-4/jackson-databind=notaffe |rhmap-4/jackson-databind=no |cted,openshift-enterprise-3 |taffected,openshift-enterpr |.11/logging-elasticsearch5- |ise-3.11/logging-elasticsea |container=affected,openshif |rch5-container=affected,ope |t-enterprise-3.10/elasticse |nshift-enterprise-3.10/elas |arch-cloud-kubernetes=affec |ticsearch-cloud-kubernetes= |ted,openshift-enterprise-3. |affected,openshift-enterpri |9/elasticsearch-cloud-kuber |se-3.9/elasticsearch-cloud- |netes=affected,openshift-en |kubernetes=affected,openshi |terprise-3.7/elasticsearch- |ft-enterprise-3.7/elasticse |cloud-kubernetes=new,opensh |arch-cloud-kubernetes=new,o |ift-enterprise-3.6/elastics |penshift-enterprise-3.6/ela |earch-cloud-kubernetes=new, |sticsearch-cloud-kubernetes |openshift-enterprise-3.10/o |=new,openshift-enterprise-3 |penshift-elasticsearch-plug |.10/openshift-elasticsearch |in=affected,openshift-enter |-plugin=affected,openshift- |prise-3.9/openshift-elastic |enterprise-3.9/openshift-el |search-plugin=affected,open |asticsearch-plugin=affected |shift-enterprise-3.7/opensh |,openshift-enterprise-3.7/o |ift-elasticsearch-plugin=wo |penshift-elasticsearch-plug |ntfix,openshift-enterprise- |in=wontfix,openshift-enterp |3.6/openshift-elasticsearch |rise-3.6/openshift-elastics |-plugin=wontfix,openshift-e |earch-plugin=wontfix,opensh |nterprise-4.1/logging-elast |ift-enterprise-4.1/logging- |icsearch5-container=affecte |elasticsearch5-container=af |d,openshift-4.2/logging-ela |fected,openshift-4.2/loggin |sticsearch5-container=affec |g-elasticsearch5-container= |ted |affected

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

errata-xmlrpc errata-xmlrpc@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:2720

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:2858 https://access.redhat.com/errata/RHSA-2019:2858

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2019:2937 https://access.redhat.com/errata/RHSA-2019:2937

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2019:2935 https://access.redhat.com/errata/RHSA-2019:2935

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2019:2936 https://access.redhat.com/errata/RHSA-2019:2936

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform

Via RHSA-2019:2938 https://access.redhat.com/errata/RHSA-2019:2938

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #33 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Openshift Application Runtimes

Via RHSA-2019:2998 https://access.redhat.com/errata/RHSA-2019:2998

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #35 from Kunjan Rathod krathod@redhat.com --- This vulnerability is out of security support scope for the following products: * Red Hat JBoss BPM Suite 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

errata-xmlrpc errata-xmlrpc@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3292

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

errata-xmlrpc errata-xmlrpc@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3297

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

errata-xmlrpc errata-xmlrpc@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:3901

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

errata-xmlrpc errata-xmlrpc@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2019:4352

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #42 from Jonathan Christison jochrist@redhat.com --- Mitigation:

This vulnerability relies on logback-core (ch.qos.logback.core) being present in the application's ClassPath. logback-core is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use logback-core are not impacted by this vulnerability.

This issue affects the versions of jackson-databind bundled with candlepin as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time: * Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore candlepin should not be affected.

General mitigation: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #43 from Eric Christensen sparks@redhat.com --- Statement:

Red Hat OpenStack's OpenDaylight does not use logback in any supported configuration. Therefore, the prerequisites for this vulnerability are not present and OpenDaylight is not affected.

This vulnerability relies on logback-core (ch.qos.logback.core) being present in the application's ClassPath. Logback-core is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use logback-core are not impacted by this vulnerability.

This issue affects the versions of jackson-databind bundled with candlepin as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time.

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #45 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983

https://bugzilla.redhat.com/show_bug.cgi?id=1725807

--- Comment #48 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Via RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856