Sigurnosni nedostaci programskog paketa rh-maven35-jackson-databind

Preporuke

by - 18. travnja 2019.0

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: rh-maven35-jackson-databind security update
Advisory ID: RHSA-2019:0782-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0782
Issue date: 2019-04-17
CVE Names: CVE-2018-11307 CVE-2018-12022 CVE-2018-12023
CVE-2018-14718 CVE-2018-14719 CVE-2018-14720
CVE-2018-14721 CVE-2018-19360 CVE-2018-19361
CVE-2018-19362
=====================================================================

1. Summary:

An update for rh-maven35-jackson-databind is now available for Red Hat
Software Collections.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) – noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) – noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) – noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) – noarch
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) – noarch

3. Description:

The jackson-databind package provides general data-binding functionality
for Jackson, which works on top of Jackson core streaming API.

Security Fix(es):

* jackson-databind: Potential information exfiltration with default typing,
serialization gadget from MyBatis (CVE-2018-11307)

* jackson-databind: improper polymorphic deserialization of types from
Jodd-db library (CVE-2018-12022)

* jackson-databind: improper polymorphic deserialization of types from
Oracle JDBC driver (CVE-2018-12023)

* jackson-databind: arbitrary code execution in slf4j-ext class
(CVE-2018-14718)

* jackson-databind: arbitrary code execution in blaze-ds-opt and
blaze-ds-core classes (CVE-2018-14719)

* jackson-databind: improper polymorphic deserialization in
axis2-transport-jms class (CVE-2018-19360)

* jackson-databind: improper polymorphic deserialization in openjpa class
(CVE-2018-19361)

* jackson-databind: improper polymorphic deserialization in
jboss-common-core class (CVE-2018-19362)

* jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)

* jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
(CVE-2018-14721)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1666415 – CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
1666418 – CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
1666423 – CVE-2018-14720 jackson-databind: exfiltration/XXE in some JDK classes
1666428 – CVE-2018-14721 jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
1666482 – CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class
1666484 – CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class
1666489 – CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class
1671096 – CVE-2018-12023 jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver
1671097 – CVE-2018-12022 jackson-databind: improper polymorphic deserialization of types from Jodd-db library
1677341 – CVE-2018-11307 jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):