CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration.\r\n\r\n Security Fix(es):\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.(CVE-2020-35490)\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.(CVE-2020-35491)\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).(CVE-2020-35728)\r\n\r\n FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.(CVE-2020-36185)\r\n\r\n

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 20 CVEs. Fixed in 2.9.10.5-tuxcare.1.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.9.10.7-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.9.10.4-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.8.5-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.9.7-tuxcare.3.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.9.1-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 14 CVEs. Fixed in 2.8.11.3-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.10-tuxcare.3.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.11.1-tuxcare.3.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.10.3-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 13 CVEs. Fixed in 2.9.9-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 16 CVEs. Fixed in 2.9.9.3-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 13 CVEs. Fixed in 2.8.11.4-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 19 CVEs. Fixed in 2.9.5-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 21 CVEs. Fixed in 2.7.9-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.9.4-tuxcare.3.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.7.3-tuxcare.3.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 14 CVEs. Fixed in 2.9.10.1-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.9.7-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.9.2-tuxcare.3.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.8.4-tuxcare.5.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.5-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.7.8-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.8.11-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.9.10.6-tuxcare.2.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.7.0-tuxcare.4.

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 16 CVEs. Fixed in 2.7.9.3-tuxcare.4.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation (CVE-2019-12086).

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible (CVE-2019-12384).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server (CVE-2019-12814).

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution (CVE-2019-14379).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath (CVE-2019-14439).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig (CVE-2019-14540).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540 (CVE-2019-16335).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling (CVE-2019-16942).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling (CVE-2019-16943).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup (CVE-2019-17267).

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload (CVE-2019-17531).

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking (CVE-2019-20330).

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain…

These are all security issues fixed in the jackson-databind-2.10.5.1-2.2 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2020-35728 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.

This update for jackson-databind fixes the following issues:

jackson-databind was updated to 2.10.5.1:

• #2589: DOMDeserializer: setExpandEntityReferences(false) may not prevent external entity expansion in all cases (CVE-2020-25649, bsc#1177616)
• #2787 (partial fix): NPE after add mixin for enum
• #2679: 'ObjectMapper.readValue('123', Void.TYPE)' throws 'should never occur'