RHSA-2019:3901HighCVSS 9.8

Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Vert.x 3.8.3 security update

Published
November 18, 2019
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2019-17267 →CVE-2019-10174 →CVE-2019-12384 →CVE-2019-14379 →CVE-2019-16869 →CVE-2019-16942 →CVE-2019-16943 →

📋 Description

CVE-2019-10174 — infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods CVE-2019-12384 — jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution CVE-2019-14379 — jackson-databind: default typing mishandling leading to remote code execution CVE-2019-16869 — netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers CVE-2019-16942 — jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* CVE-2019-16943 — jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource CVE-2019-17267 — jackson-databind: Serialization gadgets in classes of the ehcache package

🎯 Affected products1

  • Red Hat Openshift Application Runtimes Vert.x 3.8.3

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: There is no known mitigation for this issue. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: * Use HTTP/2 instead (clear boundaries between requests) * Disable reuse of backend connections eg. ```http-reuse never``` in HAProxy or whatever equivalent LB settings

🔗 References (10)