RHSA-2019:1820HighCVSS 8.1

Red Hat Security Advisory: rh-maven35-jackson-databind security update

Published
July 22, 2019
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2019-12384 →

📋 Description

CVE-2019-12384 — jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

🎯 Affected products20

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-0:2.7.6-2.6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • rh-maven35-jackson-databind-javadoc-0:2.7.6-2.6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (4)