Red Hat Produkte: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• Critical 9.8
  CVE-2019-14379

  Deserialization of untrusted data in FasterXML jackson-databind

  SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jul 29, 2019
• High 8.1
  CVE-2019-10202

  Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl

  A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackso…

  Red Hat codehaus tez spark-4.0-scala-2.13 Wolfi Maven
  Oct 1, 2019
• High 7.5
  CVE-2019-12086 Public exploit EPSS 22%

  Information exposure in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  May 17, 2019
• Medium 5.9
  CVE-2019-12384 Public exploit EPSS 45%

  Deserialization of Untrusted Data in FasterXML jackson-databind

  FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 24, 2019
• Medium 5.9
  CVE-2019-12814 Public exploit EPSS 11%

  Deserialization of untrusted data in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the class…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 19, 2019
• Medium 5.3
  CVE-2019-10184

  Undertow Missing Authorization when requesting a protected directory without trailing slash

  undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

  undertow-io undertow undertow undertow Debian Ubuntu Maven
  Jul 25, 2019
• Medium 4.8
  CVE-2019-10212

  Potential to access user credentials from the log files when debug logging enabled

  A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Oct 2, 2019

Revision history

1. 2026-08-11 #14

   Neue Updates von IBM aufgenommen

2. 2022-03-10 #13

   Neue Updates von NetApp aufgenommen

3. 2021-04-26 #12

   Neue Updates von Red Hat aufgenommen

4. 2020-12-16 #11

   Neue Updates von Red Hat aufgenommen

5. 2020-07-28 #10

   Neue Updates von Red Hat aufgenommen

6. 2020-04-14 #9

   Neue Updates von Red Hat aufgenommen

7. 2020-03-26 #8

   Neue Updates von Red Hat aufgenommen

8. 2020-03-05 #7

   Neue Updates von Red Hat aufgenommen

9. 2019-11-18 #6

   Neue Updates von Red Hat aufgenommen

10. 2019-10-31 #5

    Neue Updates von Red Hat aufgenommen

11. 2019-10-20 #4

    Neue Updates von Red Hat aufgenommen

12. 2019-10-14 #3

    Neue Updates von Red Hat aufgenommen

13. 2019-10-09 #2

    Neue Updates von Red Hat aufgenommen

14. 2019-09-30 #1

    Initiale Fassung

References

• Red Hat Security Advisory: 2019-2938 vom 2019-09-30
  https://access.redhat.com/errata/RHSA-2019:2938
• Red Hat Security Advisory
  https://access.redhat.com/errata/RHSA-2019:2937
• Red Hat Security Advisory
  https://access.redhat.com/errata/RHSA-2019:2936
• Red Hat Security Advisory
  https://access.redhat.com/errata/RHSA-2019:2935
• Red Hat Security Advisory RHSA-2019:2998 vom 2019-10-10
  https://access.redhat.com/errata/RHSA-2019:2998
• Red Hat Security Advisory RHSA-2019:3050 vom 2019-10-14
  https://access.redhat.com/errata/RHSA-2019:3050
• Red Hat Security Advisory RHSA-2019:3045 vom 2019-10-14
  https://access.redhat.com/errata/RHSA-2019:3045
• Red Hat Security Advisory RHSA-2019:3044 vom 2019-10-14
  https://access.redhat.com/errata/RHSA-2019:3044
• Red Hat Security Advisory RHSA-2019:3046 vom 2019-10-14
  https://access.redhat.com/errata/RHSA-2019:3046
• Red Hat Security Advisory RHSA-2019:3149 vom 2019-10-18
  https://access.redhat.com/errata/RHSA-2019:3149
• Red Hat Security Advisory RHSA-2019:3292 vom 2019-10-31
  https://access.redhat.com/errata/RHSA-2019:3292
• Red Hat Security Advisory RHSA-2019:3297 vom 2019-10-31
  https://access.redhat.com/errata/RHSA-2019:3297
• Red Hat Security Advisory RHSA-2019:3901 vom 2019-11-18
  https://access.redhat.com/errata/RHSA-2019:3901
• Red Hat Security Advisory RHSA-2020:0727 vom 2020-03-05
  https://access.redhat.com/errata/RHSA-2020:0727
• Red Hat Security Advisory RHSA-2020:0983 vom 2020-03-26
  https://access.redhat.com/errata/RHSA-2020:0983
• Red Hat Security Advisory RHSA-2020:1454 vom 2020-04-14
  https://access.redhat.com/errata/RHSA-2020:1454
• Red Hat Security Advisory RHSA-2020:3192 vom 2020-07-28
  https://access.redhat.com/errata/RHSA-2020:3192
• Red Hat Security Advisory RHSA-2020:5568 vom 2020-12-16
  https://access.redhat.com/errata/RHSA-2020:5568
• Red Hat Security Advisory RHSA-2021:1230 vom 2021-04-27
  https://access.redhat.com/errata/RHSA-2021:1230
• NetApp Security Advisory NTAP-20220210-0017 vom 2022-03-10
  https://security.netapp.com/advisory/ntap-20220210-0017/
• IBM Security Bulletin 7282926 vom 2026-08-11
  https://www.ibm.com/support/pages/node/7282926