A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
89660FC3-9198-414C-B89D-C61A4438BA3B
2.7.9.6
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
5DB8A2D4-0FDE-4216-896B-52824106B97B
2.8.11.4
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
04641592-DAF4-47BB-A9DE-FC4C84A20401
2.9.9.2
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
OR
Similar to other polymorphic types with no limits, but for XXE with `jdom2.jar`, tracked as `CVE-2019-12814`.

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Fixed in:

* 2.9.10
* 2.8.11.4
* 2.7.9.6
* 2.6.7.3

Block yet another gadget type (jdom, CVE-2019-12814)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block yet another gadget type (jdom, CVE-2019-12814)
Issue date:

--- start body ---
Similar to other polymorphic types with no limits, but for XXE with `jdom2.jar`, tracked as `CVE-2019-12814`.

See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Fixed in:

* 2.9.10
* 2.8.11.4
* 2.7.9.6
* 2.6.7.3

--- end body ---

comments :
--- start comments ---

--- end comments ---