A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10

Overview

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Affected

• jackson-databind >= 2.0.0, < 2.6.7.3
• jackson-databind >= 2.8.0, < 2.8.11.5
• jackson-databind >= 2.9.0, < 2.9.10.1
• debian_linux = 8.0
• debian_linux = 9.0
• debian_linux = 10.0
• fedora = 30
• fedora = 31
• jboss_enterprise_application_platform = 7.2.0
• jboss_enterprise_application_platform = 7.3
• active_iq_unified_manager >= 7.3
• active_iq_unified_manager >= 9.5
• oncommand_api_services
• oncommand_workflow_automation
• service_level_manager
• steelstore_cloud_integrated_storage
• banking_platform = 2.4.0
• banking_platform = 2.4.1
• banking_platform = 2.5.0
• banking_platform = 2.6.0
• banking_platform = 2.6.1
• banking_platform = 2.6.2
• banking_platform = 2.7.0
• banking_platform = 2.7.1
• banking_platform = 2.9.0
• communications_billing_and_revenue_management = 7.5.0.23.0
• communications_billing_and_revenue_management = 12.0.0.3.0
• communications_calendar_server = 8.0.0.2.0
• communications_calendar_server = 8.0.0.3.0
• communications_cloud_native_core_network_slice_selection_function = 1.2.1
• communications_evolved_communications_application_server = 7.1
• database_server = 12.2.0.1
• database_server = 18c
• database_server = 19c
• global_lifecycle_management_nextgen_oui_framework = 12.2.1.3.0
• global_lifecycle_management_nextgen_oui_framework = 12.2.1.4.0
• global_lifecycle_management_nextgen_oui_framework = 13.9.4.2.2
• goldengate_application_adapters = 19.1.0.0.0
• jd_edwards_enterpriseone_orchestrator = 9.2
• jd_edwards_enterpriseone_tools = 9.2
• primavera_gateway >= 17.12.0, <= 17.12.6
• primavera_gateway >= 18.8.0, <= 18.8.8
• primavera_gateway = 19.12.0
• primavera_unifier >= 17.7, <= 17.12
• primavera_unifier = 16.1
• primavera_unifier = 16.2
• primavera_unifier = 18.8
• primavera_unifier = 19.12
• retail_merchandising_system = 15.0.3
• retail_merchandising_system = 16.0.2
• retail_merchandising_system = 16.0.3
• retail_sales_audit = 14.1
• siebel_engineering_-_installer_&_deployment <= 2.20.5
• siebel_ui_framework <= 20.5
• siebel_ui_framework = 20.6
• webcenter_portal = 12.2.1.3.0
• webcenter_portal = 12.2.1.4.0
• webcenter_sites = 12.2.1.3.0
• webcenter_sites = 12.2.1.4.0
• weblogic_server = 12.2.1.3.0
• weblogic_server = 12.2.1.4.0

Remediation

Upgrade past the affected range:

• jackson-databind 2.9.10.1