RHSA-2019:4037HighCVSS 8.1

Red Hat Security Advisory: Red Hat Data Grid 7.3.2 security update

Published
December 2, 2019
Last Modified
August 4, 2026

🔗 CVE IDs covered (11)

CVE-2018-12022 →CVE-2018-12023 →CVE-2018-14720 →CVE-2018-14721 →CVE-2018-19361 →CVE-2018-19362 →CVE-2018-11307 →CVE-2018-14718 →CVE-2018-14719 →CVE-2018-19360 →CVE-2019-10158 →

📋 Description

CVE-2018-11307 — jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis CVE-2018-12022 — jackson-databind: improper polymorphic deserialization of types from Jodd-db library CVE-2018-12023 — jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver CVE-2018-14718 — jackson-databind: arbitrary code execution in slf4j-ext class CVE-2018-14719 — jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes CVE-2018-14720 — jackson-databind: exfiltration/XXE in some JDK classes CVE-2018-14721 — jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class CVE-2018-19360 — jackson-databind: improper polymorphic deserialization in axis2-transport-jms class CVE-2018-19361 — jackson-databind: improper polymorphic deserialization in openjpa class CVE-2018-19362 — jackson-databind: improper polymorphic deserialization in jboss-common-core class CVE-2019-10158 — infinispan: Session fixation protection broken for Spring Session integration

🎯 Affected products1

  • Red Hat Data Grid

✅ Remediation

To install this update, do the following: 1. Download the Data Grid 7.3.2 server patch from the customer portal. 2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on. 3. Install the Data Grid 7.3.2 server patch. Refer to the 7.3 Release Notes for patching instructions. 4. Restart Data Grid to ensure the changes take effect. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (16)