A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
BF323F3D-B2A4-41E7-94F9-5539C9B7025E
2.8.11.5
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
18324CA7-89A0-4212-B603-E9C3DD998219
2.9.10.1
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
97A4B8DF-58DA-4AB6-A1F9-331B36409BA3
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
80F0FA5D-8D3B-4C0E-81E2-87998286AF33
OR
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
0952BA1A-5DF9-400F-B01F-C3A398A8A2D4
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
B4911A72-5FAE-47C5-A141-2E3CA8E1CCAB
OR
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
142AD0DD-4CF3-4D74-9442-459CE3347E3A
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
F4CFF558-3C47-480D-A2F0-BABF26042943
OR
AND
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*
9FBC1BD0-FF12-4691-8751-5F245D991989
7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
BD075607-09B7-493E-8611-66D041FFDA62
7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB
9.5
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
5EC98B22-FFAA-4B59-8E63-EBAA4336AD13
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
5735E553-9731-4AAC-BCFF-989377F817B3
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
7081652A-D28B-494E-94EF-CA88117F23EE
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
E94F7F59-1785-493F-91A7-5F5EA5E87E4D
OR
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
C2BEE49E-A5AA-42D3-B422-460454505480
cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
F4FF66F7-10C8-4A1C-910A-EF7D12A4284C
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
35AD0C07-9688-4397-8D45-FBB88C0F0C11
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
8972497F-6E24-45A9-9A18-EB0E842CB1D4
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
400509A8-D6F2-432C-A2F1-AD5B8778D0D9
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
132CE62A-FBFC-4001-81EC-35D81F73AF48
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
282150FF-C945-4A3E-8A80-E8757A8907EA
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
645AA3D1-C8B5-4CD2-8ACE-31541FA267F0
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
AB9FC9AB-1070-420F-870E-A5EC43A924A4
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
790A89FD-6B86-49AE-9B4F-AE7262915E13
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
E39D442D-1997-49AF-8B02-5640BE2A26CC
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*
559579F1-3975-45C5-9F62-2F0A5AF13E84
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:*
50882F8D-9740-4CC0-B2C6-CCE4F6D90C7C
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*
ADE6EF8F-1F05-429B-A916-76FDB20CEB81
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
987811D5-DA5E-493D-8709-F9231A84E5F9
cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*
5C614BA7-7103-4ED7-ADD0-56064FE256A3
cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*
6833701E-5510-4180-9523-9CFD318DEE6A
cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:*
B2204841-585F-40C7-A1D9-C34E612808CA
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*
08A37FE9-B626-48C3-8FE0-D4F1A559E0B8
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*
6495B29F-3DA2-4628-9CC0-39617871F3AD
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
5A6FFB5C-EB44-499F-BE81-24ED2B1F201A
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
E7BE0590-31BD-4FCD-B50E-A5F86196F99E
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
989598A3-7012-4F57-B172-02404E20D16D
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
41684398-18A4-4DC6-B8A2-3EBAA0CBF9A6
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
BA6FCD1C-9093-4630-8016-B70F25C34358
17.12.6
17.12.0
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
597495A7-FE17-4B31-804D-B28C2B872B4D
18.8.8
18.8.0
cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*
B201A85E-1310-46B8-8A3B-FF7675F84E09
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
08FA59A8-6A62-4B33-8952-D6E658F8DAC9
17.12
17.7
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
D55A54FD-7DD1-49CD-BE81-0BE73990943C
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
82EB08C0-2D46-4635-88DF-E54F6452D3A3
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
202AD518-2E9B-4062-B063-9858AE1F9CE2
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
10864586-270E-4ACF-BDCC-ECFCD299305F
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
E7C9BB48-50B2-4735-9E2F-E492C708C36D
cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*
4A848888-0A4A-4B6D-8176-9A2685B37AC2
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
F8383028-B719-41FD-9B6A-71F8EB4C5F8D
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
7DA6E92C-AC3B-40CF-96AE-22CD8769886F
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
A83C7FAE-9848-427E-88F8-BFA24134A84B
2.20.5
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
F510ED6D-7BF8-4548-BF0F-3CF926EB135E
20.5
cpe:2.3:a:oracle:siebel_ui_framework:20.6:*:*:*:*:*:*:*
E66708CA-D7AC-4FE8-97D5-E8998A40CC85
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
D6A4F71A-4269-40FC-8F61-1D1301F2B728
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
5A502118-5B2B-47AE-82EC-1999BD841103
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
D551CAB1-4312-44AA-BDA8-A030817E153A
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
174A6D2E-E42E-4C92-A194-C6A820CD7EF4
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
F14A818F-AA16-4438-A3E4-E64C9287AC66
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418
OR
Another 2 gadget (*) types reported regarding classes of `commons-dbcp` and `p6spy` packages.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2019-16942 (commons-dbcp)
Mitre id:  CVE-2019-16943 (p6spy)
Reporter: b5mali4

Fixed in:

* 2.9.10.1 (use `jackson-bom` version `2.9.10.20191020`)
* 2.6.7.3
* 2.8.11.5
* does not affect 2.10.0 and later

Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 / CVE-2019-16943)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block two more gadget types (commons-dbcp, p6spy, CVE-2019-16942 / CVE-2019-16943)
Issue date:

--- start body ---
Another 2 gadget (*) types reported regarding classes of `commons-dbcp` and `p6spy` packages.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Mitre id: CVE-2019-16942 (commons-dbcp)
Mitre id:  CVE-2019-16943 (p6spy)
Reporter: b5mali4

Fixed in:

* 2.9.10.1 (use `jackson-bom` version `2.9.10.20191020`)
* 2.6.7.3
* 2.8.11.5
* does not affect 2.10.0 and later

--- end body ---

comments :
--- start comments ---

--- end comments ---