A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
5F83B193-74CF-459A-8055-AE0F033D5BCB
2.8.11.5
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
18324CA7-89A0-4212-B603-E9C3DD998219
2.9.10.1
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
OR
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*
0C3AA5CE-9ACB-4E96-A4C1-50A662D641FB
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
B4911A72-5FAE-47C5-A141-2E3CA8E1CCAB
OR
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
9BBCD86A-E6C7-4444-9D74-F861084090F0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
51EF4996-72F4-4FA4-814F-F5991E7A8318
cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:*
B0FEFCDD-A212-4525-B449-2C4A00A0D2E9
OR
AND
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
C2BEE49E-A5AA-42D3-B422-460454505480
cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
F4FF66F7-10C8-4A1C-910A-EF7D12A4284C
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
35AD0C07-9688-4397-8D45-FBB88C0F0C11
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
8972497F-6E24-45A9-9A18-EB0E842CB1D4
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
400509A8-D6F2-432C-A2F1-AD5B8778D0D9
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
132CE62A-FBFC-4001-81EC-35D81F73AF48
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
282150FF-C945-4A3E-8A80-E8757A8907EA
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
645AA3D1-C8B5-4CD2-8ACE-31541FA267F0
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
AB9FC9AB-1070-420F-870E-A5EC43A924A4
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
790A89FD-6B86-49AE-9B4F-AE7262915E13
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
E39D442D-1997-49AF-8B02-5640BE2A26CC
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*
559579F1-3975-45C5-9F62-2F0A5AF13E84
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:*
50882F8D-9740-4CC0-B2C6-CCE4F6D90C7C
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*
ADE6EF8F-1F05-429B-A916-76FDB20CEB81
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
987811D5-DA5E-493D-8709-F9231A84E5F9
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*
08A37FE9-B626-48C3-8FE0-D4F1A559E0B8
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*
6495B29F-3DA2-4628-9CC0-39617871F3AD
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
5A6FFB5C-EB44-499F-BE81-24ED2B1F201A
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
E7BE0590-31BD-4FCD-B50E-A5F86196F99E
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
989598A3-7012-4F57-B172-02404E20D16D
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
41684398-18A4-4DC6-B8A2-3EBAA0CBF9A6
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
3C209FAC-B7DE-42DC-AC9C-BD3ADA44D0B7
17.12.6
17.7
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
597495A7-FE17-4B31-804D-B28C2B872B4D
18.8.8
18.8.0
cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:*
DADAD14D-4836-4C74-A474-B8A044EED2EB
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
0513B305-97EF-4609-A82E-D0CDFF9925BA
cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*
B201A85E-1310-46B8-8A3B-FF7675F84E09
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
E7C9BB48-50B2-4735-9E2F-E492C708C36D
cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*
4A848888-0A4A-4B6D-8176-9A2685B37AC2
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
F8383028-B719-41FD-9B6A-71F8EB4C5F8D
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
7DA6E92C-AC3B-40CF-96AE-22CD8769886F
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
A83C7FAE-9848-427E-88F8-BFA24134A84B
2.20.5
cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*
EDB52969-7705-47CF-BD55-5632C56A7FD1
cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:*
67107890-A521-47E7-BC10-00635C85BEC4
cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:*
9B3C1811-E651-4975-A1AE-BCE3377D51A0
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
D6A4F71A-4269-40FC-8F61-1D1301F2B728
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
5A502118-5B2B-47AE-82EC-1999BD841103
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
D551CAB1-4312-44AA-BDA8-A030817E153A
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
174A6D2E-E42E-4C92-A194-C6A820CD7EF4
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
F14A818F-AA16-4438-A3E4-E64C9287AC66
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418
OR
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
OR
Another  gadget type reported regarding a class of apache-log4j-extras package.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2019-17531
Reporter: 张先辉 Zhangxianhui

Fix will be included in:

* 2.9.10.1
* 2.8.11.5
* 2.6.7.3
* does not affect 2.10.0 and later

Block one more gadget type (apache-log4j-extras/1.2, CVE-2019-17531)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (apache-log4j-extras/1.2, CVE-2019-17531)
Issue date:

--- start body ---
Another  gadget type reported regarding a class of apache-log4j-extras package.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2019-17531
Reporter: 张先辉 Zhangxianhui

Fix will be included in:

* 2.9.10.1
* 2.8.11.5
* 2.6.7.3
* does not affect 2.10.0 and later

--- end body ---

comments :
--- start comments ---

--- end comments ---