[SECURITY] [DLA 1943-1] jackson-databind security update

2019-10-0222:48:42

lists.debian.org

313

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

73.4%

JSON

Package : jackson-databind
Version : 2.4.2-2+deb8u9
CVE ID : CVE-2019-14540 CVE-2019-16335 CVE-2019-16942
CVE-2019-16943
Debian Bug : 940498 941530

More deserialization flaws were discovered in jackson-databind
relating to the classes in com.zaxxer.hikari.HikariConfig,
com.zaxxer.hikari.HikariDataSource, commons-dbcp and
com.p6spy.engine.spy.P6DataSource, which could allow an
unauthenticated user to perform remote code execution. The issue was
resolved by extending the blacklist and blocking more classes from
polymorphic deserialization.

For Debian 8 "Jessie", these problems have been fixed in version
2.4.2-2+deb8u9.

We recommend that you upgrade your jackson-databind packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8alllibjackson2-databind-java-doc< 2.4.2-2+deb8u9libjackson2-databind-java-doc_2.4.2-2+deb8u9_all.deb
Debian8alljackson-databind< 2.4.2-2+deb8u9jackson-databind_2.4.2-2+deb8u9_all.deb
Debian8alllibjackson2-databind-java< 2.4.2-2+deb8u9libjackson2-databind-java_2.4.2-2+deb8u9_all.deb
Debian10alllibjackson2-databind-java-doc< 2.9.8-3+deb10u1libjackson2-databind-java-doc_2.9.8-3+deb10u1_all.deb
Debian9alllibjackson2-databind-java-doc< 2.8.6-1+deb9u6libjackson2-databind-java-doc_2.8.6-1+deb9u6_all.deb
Debian10alllibjackson2-databind-java< 2.9.8-3+deb10u1libjackson2-databind-java_2.9.8-3+deb10u1_all.deb
Debian9alljackson-databind< 2.8.6-1+deb9u6jackson-databind_2.8.6-1+deb9u6_all.deb
Debian10alljackson-databind< 2.9.8-3+deb10u1jackson-databind_2.9.8-3+deb10u1_all.deb
Debian9alllibjackson2-databind-java< 2.8.6-1+deb9u6libjackson2-databind-java_2.8.6-1+deb9u6_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	libjackson2-databind-java-doc	< 2.4.2-2+deb8u9	libjackson2-databind-java-doc_2.4.2-2+deb8u9_all.deb
Debian	8	all	jackson-databind	< 2.4.2-2+deb8u9	jackson-databind_2.4.2-2+deb8u9_all.deb
Debian	8	all	libjackson2-databind-java	< 2.4.2-2+deb8u9	libjackson2-databind-java_2.4.2-2+deb8u9_all.deb
Debian	10	all	libjackson2-databind-java-doc	< 2.9.8-3+deb10u1	libjackson2-databind-java-doc_2.9.8-3+deb10u1_all.deb
Debian	9	all	libjackson2-databind-java-doc	< 2.8.6-1+deb9u6	libjackson2-databind-java-doc_2.8.6-1+deb9u6_all.deb
Debian	10	all	libjackson2-databind-java	< 2.9.8-3+deb10u1	libjackson2-databind-java_2.9.8-3+deb10u1_all.deb
Debian	9	all	jackson-databind	< 2.8.6-1+deb9u6	jackson-databind_2.8.6-1+deb9u6_all.deb
Debian	10	all	jackson-databind	< 2.9.8-3+deb10u1	jackson-databind_2.9.8-3+deb10u1_all.deb
Debian	9	all	libjackson2-databind-java	< 2.8.6-1+deb9u6	libjackson2-databind-java_2.8.6-1+deb9u6_all.deb