CVE-2018-19361
jackson-databind: improper polymorphic deserialization in openjpa class
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.fasterxml.jackson.core:jackson-databind | 2.7.9.5, 2.9.8, 2.8.11.3 |
| debian 11 | jackson-databind | 2.9.8-1 |
| debian 12 | jackson-databind | 2.9.8-1 |
| debian 13 | jackson-databind | 2.9.8-1 |
| debian 14 | jackson-databind | 2.9.8-1 |
| debian 8 | jackson-databind | 2.4.2-2+deb8u5 |
| debian 9 | jackson-databind | 2.8.6-1+deb9u5 |
| echo | jackson-databind | 2.9.8-1 |
| Red Hat | elasticsearch-cloud-kubernetes, opendaylight, openshift-elasticsearch-plugin | sin corrección indicada |
| ubuntu 16.04-ESM | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |
| ubuntu 19.04 | jackson-databind | 2.9.8-1 |
| ubuntu 19.10 | jackson-databind | 2.9.8-1 |
Mostrar las 29 entradas de 27 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.fasterxml.jackson.core:jackson-databind | 2.7.9.5, 2.9.8, 2.8.11.3 |
| debian 11 | jackson-databind | 2.9.8-1 |
| debian 12 | jackson-databind | 2.9.8-1 |
| debian 13 | jackson-databind | 2.9.8-1 |
| debian 14 | jackson-databind | 2.9.8-1 |
| debian 8 | jackson-databind | 2.4.2-2+deb8u5 |
| debian 9 | jackson-databind | 2.8.6-1+deb9u5 |
| echo | jackson-databind | 2.9.8-1 |
| Red Hat | elasticsearch-cloud-kubernetes | sin corrección indicada |
| Red Hat | opendaylight | sin corrección indicada |
| Red Hat | openshift-elasticsearch-plugin | sin corrección indicada |
| ubuntu 16.04-ESM | jackson-databind | 2.4.2-3ubuntu0.1~esm2 |
| ubuntu 19.04 | jackson-databind | 2.9.8-1 |
| ubuntu 19.10 | jackson-databind | 2.9.8-1 |
| ubuntu 20.04 | jackson-databind | 2.9.8-1 |
| ubuntu 20.04-ESM | jackson-databind | 2.9.8-1 |
| ubuntu 20.10 | jackson-databind | 2.9.8-1 |
| ubuntu 21.04 | jackson-databind | 2.9.8-1 |
| ubuntu 21.10 | jackson-databind | 2.9.8-1 |
| ubuntu 22.04 | jackson-databind | 2.9.8-1 |
| ubuntu 22.10 | jackson-databind | 2.9.8-1 |
| ubuntu 23.04 | jackson-databind | 2.9.8-1 |
| ubuntu 23.10 | jackson-databind | 2.9.8-1 |
| ubuntu 24.04 | jackson-databind | 2.9.8-1 |
| ubuntu 24.10 | jackson-databind | 2.9.8-1 |
| ubuntu 25.04 | jackson-databind | 2.9.8-1 |
| ubuntu 25.10 | jackson-databind | 2.9.8-1 |
| ubuntu 26.04 | jackson-databind | 2.9.8-1 |
| ubuntu 26.10 | jackson-databind | 2.9.8-1 |
Referencias
- http://www.securityfocus.com/bid/107985
- https://access.redhat.com/errata/RHBA-2019:0959
- https://access.redhat.com/errata/RHSA-2019:0782
- https://access.redhat.com/errata/RHSA-2019:0877
- https://access.redhat.com/errata/RHSA-2019:1782
- https://access.redhat.com/errata/RHSA-2019:1797
- https://access.redhat.com/errata/RHSA-2019:1822
- https://access.redhat.com/errata/RHSA-2019:1823
Las 43 referencias
- https://access.redhat.com/errata/RHSA-2019:2804
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3002
- https://access.redhat.com/errata/RHSA-2019:3140
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://access.redhat.com/security/cve/CVE-2018-19361
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- https://github.com/FasterXML/jackson-databind/issues/2186
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://github.com/advisories/GHSA-mx9v-gmh4-mgqw
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-19361
- https://seclists.org/bugtraq/2019/May/68
- https://security.netapp.com/advisory/ntap-20190530-0003
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://ubuntu.com/security/notices/USN-4813-1
- https://www.cve.org/CVERecord?id=CVE-2018-19361
- https://www.debian.org/security/2019/dsa-4452
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html