A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
5F83B193-74CF-459A-8055-AE0F033D5BCB
2.8.11.5
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
FE5543DD-3F9D-45EF-8034-E1EF9657955A
2.9.10
2.9.0
OR
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
68146098-58F8-417E-B165-5182527117C4
cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*
2BF03A52-4068-47EA-8846-1E5FB708CE1A
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*
CD354E32-A8B0-484C-B4C6-9FBCD3430D2D
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*
88BF3B2C-B121-483A-AEF2-8082F6DA5310
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
B40CCE4F-EA2C-453D-BB76-6388767E5C6D
cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:*
6E57E25E-342F-411A-8840-6AF01078D09F
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*
20A6B40D-F991-4712-8E30-5FE008505CB7
OR
cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*
8DD32C20-8B17-4197-9943-B8293D1C3BED
OR
Another gadget (*) type report regarding a class of `commons-configuration` (and later `commons-configuration2`) package(s)

Mitre id: not yet allocated
Reporter: @ybhou1993

Fixed in:

* 2.9.10 and later
* 2.8.11.5
* 2.6.7.3
* does not affect 2.10.0 and later

-----

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

Block two more gadget types (commons-configuration/-2)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block two more gadget types (commons-configuration/-2)
Issue date:

--- start body ---
Another gadget (*) type report regarding a class of `commons-configuration` (and later `commons-configuration2`) package(s)

Mitre id: not yet allocated
Reporter: @ybhou1993

Fixed in:

* 2.9.10 and later
* 2.8.11.5
* 2.6.7.3
* does not affect 2.10.0 and later

-----

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

--- end body ---

comments :
--- start comments ---

--- end comments ---