Skip to content
OpenAdvisories
High · 8.1 CVE-2019-10202 EUVD-2022-3473GHSA-c27h-mcmw-48hv

Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl

Published Oct 1, 2019 · Updated Aug 4, 2024 · Assigned by redhat

Vendor: Red Hat Product: codehaus Package: org.codehaus.jackson:jackson-mapper-asl Package: spark-4.0-scala-2.13 Package: tez Ecosystem: Maven Ecosystem: Wolfi

Description

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Affected products

VendorProductAffectedFixed
RedHat codehaus Codehaus 1.9.x —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-1.redhat_00005.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-codehaus-jackson +4 1.9.13-9.redhat_00006.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.5-4.SP3_redhat_00002.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-hal-console 3.0.16-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.11-2.SP1_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-infinispan +8 9.3.7-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.17-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jackson-core +6 2.9.9-1.redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jackson-databind 2.9.9.3-1.redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jackson-jaxrs-base +2 2.9.9-2.redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.23-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-jaxrs-api_2.1_spec 1.0.3-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-logging 3.3.3-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.1.14-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.9-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-msc 1.4.8-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.14-1.SP1_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-server-migration +23 1.3.1-4.Final_redhat_00004.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.3-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-jgroups 4.0.20-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.6-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-netty +1 4.1.34-2.Final_redhat_00002.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-5.Final_redhat_00004.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-20.SP12_redhat_00007.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-undertow 2.0.25-1.SP1_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.0.6-2.Final_redhat_00002.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-wildfly +2 7.2.4-1.GA_redhat_00002.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.6.4-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-wildfly-elytron-tool 1.4.3-1.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.2.4-1.GA_redhat_00002.1.el7eap RHSA-2019:2936
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.6-2.Final_redhat_00001.1.el6eap RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling spark-4.0-scala-2.13 4.0.5-r1 —
Wolfi rolling tez No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.codehaus.jackson:jackson-mapper-asl <= 1.9.13 — GHSA-c27h-mcmw-48hv

Advisories 5

References