An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
44F16CE8-7CAD-4846-A38E-8192D56AB09B
2.7.9.4
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
02EA57F3-507D-4E70-BA77-D235A59C2800
2.8.11.2
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
429C17F2-AB58-4BC0-8EB0-AF3322DDD528
2.9.6
2.9.0
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
D100F7CE-FC64-4CC6-852A-6136D72DA419
OR
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
41684398-18A4-4DC6-B8A2-3EBAA0CBF9A6
cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*
792DF04A-2D1B-40B5-B960-3E7152732EB8
OR
cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:*
D44D4F38-4028-4EAA-895C-1E2816FB36EA
cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:*
D5CD928F-C9BA-443F-A46D-4FE7756D936B
cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:*
88C5E02F-C70E-41F4-B146-40C88439017A
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
0952BA1A-5DF9-400F-B01F-C3A398A8A2D4
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
2F87326E-0B56-4356-A889-73D026DB1D4B
cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*
E939A0E0-3437-459E-9FAB-FE42811B1D32
OR
There is a potential remote code execution (RCE) vulnerability, if user is

1. handling untrusted content (where attacker can craft JSON)
2. using "Default Typing" feature (or equivalent; polymorphic value with base type of `java.lang.Object`
3. has `jodd-db` (https://jodd.org/db/) jar in classpath
4. allows connections from service to untrusted hosts (where attacker can run an LDAP service)

(note: steps 1 and 2 are common steps as explained in https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)

To solve the issue, one type from Jodd database component is blacklisted to avoid their use as "serialization gadgets".

Original vulnerability discoverer:
吴桂雄  Wuguixiong

Fixed in:

* 2.9.6 and later
* 2.8.11.2
* 2.7.9.4
* 2.6.7.3


Block one more gadget type (jodd-db, CVE-2018-12022)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (jodd-db, CVE-2018-12022)
Issue date:

--- start body ---
There is a potential remote code execution (RCE) vulnerability, if user is

1. handling untrusted content (where attacker can craft JSON)
2. using "Default Typing" feature (or equivalent; polymorphic value with base type of `java.lang.Object`
3. has `jodd-db` (https://jodd.org/db/) jar in classpath
4. allows connections from service to untrusted hosts (where attacker can run an LDAP service)

(note: steps 1 and 2 are common steps as explained in https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)

To solve the issue, one type from Jodd database component is blacklisted to avoid their use as "serialization gadgets".

Original vulnerability discoverer:
吴桂雄  Wuguixiong

Fixed in:

* 2.9.6 and later
* 2.8.11.2
* 2.7.9.4
* 2.6.7.3


--- end body ---

comments :
--- start comments ---

--- end comments ---