The vulnerability of the implementation of the polymorphic data typing mechanism in the jackson-databind library allows a attacker to execute malicious loads.

🗓️ 22 Dec 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru

Jackson databind polymorphic typing flaw enables malicious loads via input processing weaknesses in P6DataSource.

Vulners

Node

oracle jd_edwards_enterpriseone_toolsMatch9.2

OR

oracle webcenter_portalMatch12.2.1.3.0

OR

oracle oracle_retail_customer_management_and_segmentationMatch17.0

OR

red_hat red_hat_jboss_fuseMatch7

OR

oracle retail_customer_management_and_segmentationMatch18.0

OR

oracle retail_xstore_point_of_serviceMatch15.0

OR

oracle retail_xstore_point_of_serviceMatch16.0

OR

oracle retail_xstore_point_of_serviceMatch17.0

OR

oracle retail_xstore_point_of_serviceMatch18.0

OR

red_hat jboss_enterprise_application_platformMatch7.2

OR

oracle retail_xstore_point_of_serviceMatch19.0.0

OR

fasterxml,_llc jackson-databindRange2.0.0–2.9.10

OR

red_hat jboss_enterprise_application_platformMatch7

OR

red_hat jboss_data_gridMatch7

OR

red_hat red_hat_process_automation_managerMatch7

OR

apache drillMatch1.16.0

OR

red_hat red_hat_single_sign-onMatch7.3

OR

red_hat openshift_container_platformMatch4.3

OR

red_hat red_hat_descision_managerMatch7

OR

oracle jd_edwards_enterpriseone_orchestratorMatch9.2

OR

oracle webcenter_portalMatch12.2.1.4.0

OR

oracle siebel_ui_frameworkRange≤20.5

OR

oracle communications_billing_and_revenue_managementMatch7.5.0.23.0

OR

oracle communications_billing_and_revenue_managementMatch12.0.0.3.0

OR

oracle oracle_retail_merchandising_systemMatch15.0.3

OR

oracle oracle_retail_merchandising_systemMatch16.0.2

OR

oracle oracle_retail_merchandising_systemMatch16.0.3

OR

oracle oracle_retail_sales_auditMatch14.1

OR

oracle siebel_engineering_-_installer_&_deploymentRange≤2.20.5

OR

oracle oracle_global_lifecycle_management_opatchRange≤12.2.0.1.20

OR

red_hat red_hat_enterprise_linuxMatch8

OR

fedora fedoraMatch30

OR

fedora fedoraMatch31

Source	Link
github	www.github.com/FasterXML/jackson-databind/issues/2478
lists	www.lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
lists	www.lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd@%3Ccommits.iceberg.apache.org%3E
lists	www.lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E
lists	www.lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
lists	www.lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2019/10/msg00001.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
medium	www.medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

05 Mar 2025 00:00Current

5.6Medium risk

Vulners AI Score5.6

CVSS 39.8

CVSS 210

jackson databind polymorphic typing malicious loads input processing p6spy data source