CRITICAL✓ PATCH🇬🇧 English

CVE-2019-14892

CVSS 9.8v3.1pub. 2020-03-02upd. 2024-11-21

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Geode

    APP
    Apache
    1.12.0

  • Fasterxml Jackson Databind

    APP
    Fasterxml
    2.7.0 – 2.8.11.5 (bez)2.9.0 – 2.9.10 (bez)2.0.0 – 2.6.7.3 (bez)

  • Red Hat Decision Manager

    APP
    Redhat
    7.0

  • Red Hat Jboss Data Grid

    APP
    Redhat
    7.0.0

  • Red Hat Jboss Enterprise Application Platform

    APP
    Redhat
    7.0

  • Red Hat Jboss Fuse

    APP
    Redhat
    7.0.0

  • Red Hat OpenShift Container Platform

    APP
    Redhat
    4.3

  • Red Hat Process Automation

    APP
    Redhat
    7.0
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
RCEDeserialization
CWE
Referencje

Powiązane podatności

CVE-2020-1938CRITICAL9.8⚠ KEVten sam produkt

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache To...

CVE-2019-7609CRITICAL10.0⚠ KEVten sam produkt

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. A...

CVE-2019-1003029CRITICAL9.9⚠ KEVten sam produkt

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/...

CVE-2019-1003030CRITICAL9.9⚠ KEVten sam produkt

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main...

CVE-2018-1000861CRITICAL9.8⚠ KEVten sam produkt

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.13...