CVE-2019-12384 - Deserialization of Untrusted Data

Severity

43%

Complexity

86%

Confidentiality

48%

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

CVSS 3.0 Base Score 5.9. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N).

Demo Examples

Deserialization of Untrusted Data

CWE-502

This code snippet deserializes an object from a file and uses it as a UI button:


               
}
in.close();

This code does not attempt to verify the source or contents of the file before deserializing it. An attacker may be able to replace the intended file with a file that contains arbitrary malicious code which will be executed when the button is pressed.

To mitigate this, explicitly define final readObject() to prevent deserialization. An example of this is:


               
throw new java.io.IOException("Cannot be deserialized"); }

Deserialization of Untrusted Data

CWE-502

In Python, the Pickle library handles the serialization and deserialization processes. In this example derived from [R.502.7], the code receives and parses data, and afterwards tries to authenticate a user based on validating a token.


               
}
raise AuthFail

Unfortunately, the code does not verify that the incoming data is legitimate. An attacker can construct a illegitimate, serialized object "AuthToken" that instantiates one of Python's subprocesses to execute arbitrary commands. For instance,the attacker could construct a pickle that leverages Python's subprocess module, which spawns new processes and includes a number of arguments for various uses. Since Pickle allows objects to define the process for how they should be unpickled, the attacker can direct the unpickle process to call Popen in the subprocess module and execute /bin/sh.

Overview

First reported 5 years ago

2019-06-24 16:15:00

Last updated 5 years ago

2019-09-05 14:15:00

Affected Software

Debian Linux 8.0 (Jessie)

8.0

Red Hat Enterprise Linux (RHEL) 7.0 (7)

7.0

Red Hat Enterprise Linux 7.4

7.4

Red Hat Enterprise Linux 7.5

7.5

Red Hat Enterprise Linux 7.6

7.6

Red Hat Enterprise Linux 7.7

7.7

References

RHSA-2019:1820

Third Party Advisory

RHSA-2019:2720

RHSA-2019:2858

RHSA-2019:2935

RHSA-2019:2936

RHSA-2019:2937

RHSA-2019:2938

RHSA-2019:2998

RHSA-2019:3149

RHSA-2019:3200

RHSA-2019:3292

RHSA-2019:3297

RHSA-2019:3901

RHSA-2019:4352

https://blog.doyensec.com/2019/07/22/jackson-gadgets.html

Third Party Advisory

https://doyensec.com/research.html

Third Party Advisory

https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad

Patch, Third Party Advisory

[tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to >= 2.9.9.3 to address security vulnerabilities

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

[tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[tomee-dev] 20190906 [GitHub] [tomee] rzo1 commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[struts-dev] 20190908 Build failed in Jenkins: Struts-master-JDK8-dependency-check #204

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities

[nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html

[geode-notifications] 20191007 [GitHub] [geode] jmelchio commented on issue #4102: Fix for GEODE-7255: Pickup Jackson CVE fix

[tomee-dev] 20190905 [GitHub] [tomee] robert-schaft-hon commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

[nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html

https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html

Mailing List, Third Party Advisory

FEDORA-2019-ae6a703b8f

FEDORA-2019-fb23eccc03

FEDORA-2019-99ff6aa32c

20191007 [SECURITY] [DSA 4542-1] jackson-databind security update

https://security.netapp.com/advisory/ntap-20190703-0002/

Third Party Advisory

DSA-4542

N/A

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.