https://bugzilla.redhat.com/show_bug.cgi?id=1725807
Bug ID: 1725807
Summary: CVE-2019-12384 jackson-databind: failure to block the
logback-core class from polymorphic deserialization
leading to remote code execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190621,reported=20190625,sour
ce=cve,cvss3=8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/
I:H/A:H,cwe=CWE-502,fedora-all/jackson-databind=affect
ed,amq-6/jackson-databind=new,amq-st/jackson-databind=
new,bpms-6/jackson-databind=new,openstack-8/opendaylig
ht=new,openstack-9/opendaylight=new,openstack-10/opend
aylight=new,openstack-13/opendaylight=new,openstack-14
/opendaylight=new,rhsso-7/jackson-databind=new,vertx-3
/jackson-databind=new,swarm-7/jackson-databind=new,rhe
l-8/pki-deps:10.6/jackson-databind=new,rhn_satellite_6
/jackson-databind=new,rhscl-3/rh-maven35-jackson-datab
ind=new,rhdm-7/jackson-databind=new,rhpam-7/jackson-da
tabind=new,fuse-6/jackson-databind=new,fuse-7/jackson-
databind=new,eap-7/jackson-databind=new,rhmap-4/jackso
n-databind=new,openshift-enterprise-3/ose-logging-elas
ticsearch5=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: ahardin(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bleanhar(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cbyrne(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmacedo(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dedgar(a)redhat.com,
dffrench(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, drusso(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ggaughan(a)redhat.com, hhorak(a)redhat.com,
hhudgeon(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jgoulding(a)redhat.com, jjoyce(a)redhat.com,
jkurik(a)redhat.com, jmadigan(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschluet(a)redhat.com,
jshepherd(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lpetrovi(a)redhat.com, lthon(a)redhat.com,
lzap(a)redhat.com, mat.booth(a)redhat.com,
mburns(a)redhat.com, mchappel(a)redhat.com,
mhulan(a)redhat.com, mkolesni(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, ngough(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
sdaley(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, sthorger(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com
Target Milestone: ---
Classification: Other
FasterXML jackson-databind 2.x before 2.9.9 might allow attackers to have a
variety of impacts by leveraging failure to block the logback-core class from
polymorphic deserialization. Depending on the classpath content, remote code
execution may be possible.
Upstream issue:
https://github.com/FasterXML/jackson-databind/issues/2334
Upstream patch:
https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470...
References:
https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
--
You are receiving this mail because:
You are on the CC list for the bug.