CVE-2019-17267 - 漏洞详情

CVE-2019-17267 (CNNVD-201910-227)

CRITICAL

中文标题:

FasterXML jackson-databind 代码问题漏洞

英文标题:

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related...

CVSS分数: 9.8

发布时间: 2019-10-06 23:08:53

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML jackson-databind 2.9.10之前版本中存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。

英文描述:

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

CWE类型:

CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
fasterxml	jackson-databind	*	-	-	`cpe:2.3:a:fasterxml:jackson-databind::::::::`
netapp	active_iq_unified_manager	*	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager::::::linux::*`
netapp	oncommand_api_services	-	-	-	`cpe:2.3:a:netapp:oncommand_api_services:-:::::::*`
netapp	oncommand_workflow_automation	-	-	-	`cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*`
netapp	service_level_manager	-	-	-	`cpe:2.3:a:netapp:service_level_manager:-:::::::*`
netapp	steelstore_cloud_integrated_storage	-	-	-	`cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
redhat	jboss_enterprise_application_platform	7.2	-	-	`cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:::::::*`
redhat	jboss_enterprise_application_platform	7.3	-	-	`cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:::::::*`
oracle	customer_management_and_segmentation_foundation	*	-	-	`cpe:2.3:a:oracle:customer_management_and_segmentation_foundation::::::::`
oracle	goldengate_application_adapters	19.1.0.0.0	-	-	`cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:::::::*`
oracle	retail_customer_management_and_segmentation_foundation	17.0	-	-	`cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:::::::*`
oracle	weblogic_server	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
cve.org

访问

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

RHSA-2019:3200 vendor-advisory
cve.org

访问

[debian-lts-announce] 20191210 [SECURITY] [DLA 2030-1] jackson-databind security update mailing-list
cve.org

访问

[druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191) mailing-list
cve.org

访问

RHSA-2020:0164 vendor-advisory
cve.org

访问

RHSA-2020:0159 vendor-advisory
cve.org

访问

RHSA-2020:0160 vendor-advisory
cve.org

访问

RHSA-2020:0161 vendor-advisory
cve.org

访问

RHSA-2020:0445 vendor-advisory
cve.org

访问

[skywalking-dev] 20200324 [CVE-2019-17267] Upgrade jackson-databind version to 2.9.10 mailing-list
cve.org

访问