SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5856 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.7 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.6, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.7 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 [eap-7.1.z] (CVE-2020-1710)

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean     by default [eap-7.1.z] (CVE-2019-10086)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink [eap-7.1.z]     (CVE-2022-23302)

    * jackson-databind: default typing mishandling leading to remote code execution [eap-7.1.z]     (CVE-2019-14379)

    * undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth [eap-7.1.z]     (CVE-2019-9514)

    * undertow: AJP File Read/Inclusion Vulnerability [eap-7.1.z] (CVE-2020-1745)

    * undertow: HTTP/2: large amount of data requests leads to denial of service [eap-7.1.z] (CVE-2019-9511)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass [eap-7.1.z] (CVE-2020-1757)

    * undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS [eap-7.1.z]     (CVE-2019-14888)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer [eap-7.1.z] (CVE-2022-23307)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header [eap-7.1.z] (CVE-2019-20445)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender [eap-7.1.z]     (CVE-2021-4104)

    * undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [eap-7.1.z]     (CVE-2019-9515)

    * infinispan-core: infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private     methods [eap-7.1.z] (CVE-2019-10174)

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender [eap-7.1.z]     (CVE-2022-23305)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution [eap-7.1.z] (CVE-2019-12384)

    * wildfly-security-manager: security manager authorization bypass (CVE-2019-14843)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers (CVE-2019-16869)

    * jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531)

    * netty: HTTP request smuggling (CVE-2019-20444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2743 advisory.

    The jackson-databind package provides general data-binding functionality for Jackson, which works on top     of Jackson core streaming API.

    Security Fix(es):

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4813-1 advisory.

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to obtain sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to execute arbitrary code or other unspecified impact. (CVE-2018-12022, CVE-2018-12023,     CVE-2018-14718, CVE-2018-14719, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362, CVE-2019-12384,     CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942, CVE-2019-16943,     CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968,     CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620,     CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-14195, CVE-2020-8840, CVE-2020-9546,     CVE-2020-9547, CVE-2020-9548)

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to execute XML entity (XXE) attacks. (CVE-2018-14720)

    It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly     use this issue to execute server-side request forgery (SSRF). (CVE-2018-14721)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in Oracle NoSQL Database (component: Administration (Node.js)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle NoSQL Database.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. (CVE-2021-22883)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (jackson-databind)).
    This vulnerability cannot be exploited in the context of this product. (CVE-2019-14379)

  - Vulnerability in Oracle NoSQL Database (component: Administration (Google Guava)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise     Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle NoSQL Database accessible data. (CVE-2020-8908)   
  - Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version     that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle NoSQL Database. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle NoSQL Database. (CVE-2020-11612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.15.10, or 17.7.x through 17.12.x prior to 17.12.11.1, or 18.8.x prior to 18.8.13.0. It is, therefore, affected by multiple vulnerabilities:

    - An unspecified flaw exists in how 'default typing' is handled when 'ehcache' is used in the       jackson-databind component of Primavera Unifier. An unauthenticated, remote attacker can exploit this       via the network over HTTP to cause remote code execution. (CVE-2019-14379)

    - An information disclosure vulnerability exists in the jackson-databind component of Primavera Unifier.
      An unauthenticated, remote attacker can exploit this via an externally exposed JSON endpoint if the       service has the mysql-connector-java jar in the classpath, and the attacker can host a crafted MySQL       server accessible by the victim. An attacker can send a crafted JSON message to read arbitrary local       files on the server. (CVE-2019-12086)

    - An information disclosure vulnerability exists in the jackson-databind component of Primavera Unifier.
      An unauthenticated, remote attacker can exploit this via an externally exposed JSON endpoint if the       service has the logback jar in the classpath, which can allow information disclosure. (CVE-2019-14439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.17, 16.x prior to 16.2.10, 17.x prior to 17.12.5, or 18.x prior to 18.8.7. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary file read vulnerability exists in the FasterXML jackson-databind component, which is version     2.x prior to 2.9.9. This vulnerability is due to missing com.mysql.cj.jdbc.admin.MiniAdmin validation. An     unauthenticated, remote attacker can exploit this by hosting a crafted MySQL server reachable by the     victim and sending a crated JSON message that allows them to read arbitrary files and disclose sensitive     information. (CVE-2019-12086)

  - Denial of service (DoS) vulnerabilities exist in the Apache POI component, which is prior to 3.1.7, due     to a flaw when parsing crafted WMF, EMF, MSG, macros, DOC, PPT, and XLS. An unauthenticated, remote     attacker can exploit this issue, via sending crafted input, to cause the application to stop responding.
    (CVE-2017-12626)

  - A remote code execution vulnerability exists in the FasterXML jackson-databind component, which is prior     to 2.9.0.2, due to a flaw in how default typing is handled when ehcache is used because of     net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. An unauthenticated, remote attacker     can exploit this to bypass authentication and execute arbitrary commands. (CVE-2019-14379)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3046 advisory.

    Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.3.4 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * keycloak: cross-realm user access auth bypass (CVE-2019-14832)

    * keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3045 advisory.

    Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.3.4 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * keycloak: cross-realm user access auth bypass (CVE-2019-14832)

    * keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3044 advisory.

    Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.3.4 on RHEL 6 serves as a replacement for Red Hat Single Sign-On     7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * keycloak: cross-realm user access auth bypass (CVE-2019-14832)

    * keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Update jackson-databind to version 2.9.9.3.

  - Update jackson-core to version 2.9.9.

  - Update jackson-annotations to version 2.9.9.

  - Update jackson-bom to version 2.9.9.

Resolves CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, and CVE-14439.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2937 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.4 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.3, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.4 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution (CVE-2019-12384)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files     (CVE-2019-10212)

    * codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities (CVE-2019-10202)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2936 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.4 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.3, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.4 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution (CVE-2019-12384)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files     (CVE-2019-10212)

    * codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities (CVE-2019-10202)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2935 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.4 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.3, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.4 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution (CVE-2019-12384)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     via crafted JSON message (CVE-2019-12814)

    * undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files     (CVE-2019-10212)

    * codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities (CVE-2019-10202)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Deserialization flaws were discovered in jackson-databind relating to EHCache and logback/jndi, which could allow an unauthenticated user to perform remote code execution. The issue was resolved by extending the blacklist and blocking more classes from polymorphic deserialization.

For Debian 8 'Jessie', these problems have been fixed in version 2.4.2-2+deb8u8.

We recommend that you upgrade your jackson-databind packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
206210	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 (RHSA-2024:5856)	Nessus	Red Hat Local Security Checks	critical
194154	RHEL 7 : rh-maven35-jackson-databind (RHSA-2019:2743)	Nessus	Red Hat Local Security Checks	critical
183541	Ubuntu 16.04 ESM : Jackson Databind vulnerabilities (USN-4813-1)	Nessus	Ubuntu Local Security Checks	critical
148977	Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	critical
130070	Oracle Primavera Unifier Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	CGI abuses	critical
130019	Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	CGI abuses	critical
129865	RHEL 8 : Red Hat Single Sign-On 7.3.4 security update on RHEL 8 (Important) (RHSA-2019:3046)	Nessus	Red Hat Local Security Checks	critical
129864	RHEL 7 : Red Hat Single Sign-On 7.3.4 security update on RHEL 7 (Important) (RHSA-2019:3045)	Nessus	Red Hat Local Security Checks	critical
129863	RHEL 6 : Red Hat Single Sign-On 7.3.4 security update on RHEL 6 (Important) (RHSA-2019:3044)	Nessus	Red Hat Local Security Checks	critical
129634	Fedora 31 : jackson-annotations / jackson-bom / jackson-core / jackson-databind (2019-99ff6aa32c)	Nessus	Fedora Local Security Checks	critical
129518	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 (RHSA-2019:2937)	Nessus	Red Hat Local Security Checks	critical
129517	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 (RHSA-2019:2936)	Nessus	Red Hat Local Security Checks	critical
129516	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update (Important) (RHSA-2019:2935)	Nessus	Red Hat Local Security Checks	critical
129113	Fedora 29 : jackson-annotations / jackson-bom / jackson-core / jackson-databind (2019-fb23eccc03)	Nessus	Fedora Local Security Checks	critical
129110	Fedora 30 : jackson-annotations / jackson-bom / jackson-core / jackson-databind (2019-ae6a703b8f)	Nessus	Fedora Local Security Checks	critical
127821	Debian DLA-1879-1 : jackson-databind security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-14379

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical