Back to feed
EUVD-2021-2511 · Published Dec 9, 2021
Unsafe Deserialization in jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource`.
Technologies
Fasterxml Jackson-DatabindOracle Insurance Rules PaletteOracle Communications Pricing Design CenterOracle Insurance Policy AdministrationOracle Retail Service BackboneOracle Retail Merchandising SystemOracle Primavera UnifierOracle Data IntegratorOracle Communications Services GatekeeperOracle Retail Customer Management And Segmentation FoundationNetapp Cloud BackupOracle Autovue For Agile Product Lifecycle ManagementOracle Communications Session Report ManagerOracle Banking Extensibility WorkbenchOracle Communications Cloud Native Core PolicyOracle Commerce PlatformOracle Communications Policy ManagementOracle Banking Supply Chain FinanceOracle Communications Unified Inventory ManagementOracle Banking Corporate Lending Process ManagementOracle Communications Evolved Communications Application ServerOracle Communications Convergent Charging ControllerOracle Agile PlmOracle Banking Credit Facilities Process ManagementOracle Communications Cloud Native Core Unified Data RepositoryOracle Communications Session Route ManagerOracle Jd Edwards Enterpriseone OrchestratorOracle Communications Billing And Revenue ManagementOracle Banking Virtual Account ManagementDebian Debian LinuxOracle Communications Offline Mediation ControllerOracle Jd Edwards Enterpriseone ToolsOracle Application Testing SuiteOracle Goldengate Application AdaptersOracle Primavera GatewayOracle Retail Xstore Point Of ServiceOracle Communications Diameter Signaling RouteOracle DocumakerOracle Banking Treasury ManagementOracle Communications Element ManagerNetapp Service Level ManagerOracle Blockchain PlatformOracle Webcenter PortalOracle Communications Instant Messaging ServerOracle Communications Network Charging And Control
Weaknesses
CWE-502
CVSS scores
- v3.18.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://github.com/FasterXML/jackson-databind/issues/2996
- https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- https://security.netapp.com/advisory/ntap-20210205-0005/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
Potentially impacted assets
See if this affects your attack surface
