Kritik CVSS 9.8
CVE-2019-14892: Jackson-databind: hassas bilgi ifşası
Açıklama (NVD)
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Özet bilgiler
- Ürün
- Fasterxml Jackson-databind
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %5,58 (yüzdelik 93)
- CWE
- CWE-200
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| fasterxml-jackson-databind | 2.0.0 | — | 2.6.7.3 |
| fasterxml-jackson-databind | 2.7.0 | — | 2.8.11.5 |
| fasterxml-jackson-databind | 2.9.0 | — | 2.9.10 |
| redhat-decision-manager | 7.0 | 7.0 | — |
| redhat-jboss-data-grid | — | — | — |
| redhat-jboss-data-grid | 7.0.0 | 7.0.0 | — |
| redhat-jboss-enterprise-application-platform | 7.0 | 7.0 | — |
| redhat-jboss-fuse | 7.0.0 | 7.0.0 | — |
| redhat-openshift-container-platform | 4.3 | 4.3 | — |
| redhat-process-automation | 7.0 | 7.0 | — |
| apache-geode | 1.12.0 | 1.12.0 | — |