Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.4612
rh-maven35-jackson-databind security update
11 December 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rh-maven35-jackson-databind
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux WS/Desktop 7
Red Hat Enterprise Linux Server 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-17531
Reference: ESB-2019.4601
ESB-2019.4585
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:4192
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: rh-maven35-jackson-databind security update
Advisory ID: RHSA-2019:4192-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4192
Issue date: 2019-12-10
CVE Names: CVE-2019-17531
=====================================================================
1. Summary:
An update for rh-maven35-jackson-databind is now available for Red Hat
Software Collections.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch
3. Description:
The jackson-databind package provides general data-binding functionality
for Jackson, which works on top of Jackson core streaming API.
Security Fix(es):
* jackson-databind: polymorphic typing issue when enabling default typing
for an externally exposed JSON endpoint and having apache-log4j-extra in
the classpath leads to code execution (CVE-2019-17531)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1775293 - CVE-2019-17531 jackson-databind: polymorphic typing issue when enabling default typing for an externally exposed JSON endpoint and having apache-log4j-extra in the classpath leads to code execution
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-maven35-jackson-databind-2.7.6-2.8.el7.src.rpm
noarch:
rh-maven35-jackson-databind-2.7.6-2.8.el7.noarch.rpm
rh-maven35-jackson-databind-javadoc-2.7.6-2.8.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-maven35-jackson-databind-2.7.6-2.8.el7.src.rpm
noarch:
rh-maven35-jackson-databind-2.7.6-2.8.el7.noarch.rpm
rh-maven35-jackson-databind-javadoc-2.7.6-2.8.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):
Source:
rh-maven35-jackson-databind-2.7.6-2.8.el7.src.rpm
noarch:
rh-maven35-jackson-databind-2.7.6-2.8.el7.noarch.rpm
rh-maven35-jackson-databind-javadoc-2.7.6-2.8.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):
Source:
rh-maven35-jackson-databind-2.7.6-2.8.el7.src.rpm
noarch:
rh-maven35-jackson-databind-2.7.6-2.8.el7.noarch.rpm
rh-maven35-jackson-databind-javadoc-2.7.6-2.8.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):
Source:
rh-maven35-jackson-databind-2.7.6-2.8.el7.src.rpm
noarch:
rh-maven35-jackson-databind-2.7.6-2.8.el7.noarch.rpm
rh-maven35-jackson-databind-javadoc-2.7.6-2.8.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-maven35-jackson-databind-2.7.6-2.8.el7.src.rpm
noarch:
rh-maven35-jackson-databind-2.7.6-2.8.el7.noarch.rpm
rh-maven35-jackson-databind-javadoc-2.7.6-2.8.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-17531
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXe/EE9zjgjWX9erEAQjbSg/9Es7Ynk7fnzJ/nItJnbVu/cTlY8lczJuv
liyhQ0a2uUPbeO7zcEibUnPjZ+asqkUO8Jv524iyIOoi/eBhqAhh2vvLUif73xg+
qbd/7viSBQDt45pb/M0bniSXP4EfSPMEq1xJYLl7yckCzhMakDFxJ9Yd2QjcCsiT
8fDPZR2GdYRyyB0nhUK2Emjhn5+yBwGjUBRpla3uxNJTd/ByFGHm7M0GNOvKSiXR
gjAGrum1a6CqTNBdB420s9c/rt+KQp5dKGUo8YVCCW8Y4wJ0irt5aD8MUNvjJOrX
Ds0PvGUEmZqwmARyBW2yHOJah9JaEY/v55wHXp30lxFgcb4T3WktHrpUVzYgVKdk
qO1Ajpgr14kkTXMLlPWtGpt9Hy+dA1s/1rfCp4skIHJT9ofyuWVyBGKiFBY5hj04
GMMLm4LU7cxOGlIw7/361eFdc8fCBVt3NM2H+Lpm69rpXFVhek/1unN7NeCFNCfS
NAgqyd6zF56Q9mY26T1brxWj1voemUgVPk7M+cV0fycDp8rPC62rRRQb59b8lnEl
lhx12iA3PZnrp0vPJMiNOk1ge3eD+Bzm/Z3HESRg2b33ti7TK7S9ox3JtdsTAaOO
Fg3iEiZfA2C5MX3x0+VR2FVh+yWzDDx4ziIAAGQGo96sDxCs0kyXFRoe4LohLxQu
8T9ef7CVfqQ=
=yBJc
- -----END PGP SIGNATURE-----
- --
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXfBUxWaOgq3Tt24GAQgDrhAAycyG6PQarjeOpte9d+UYXrJR2Ek/p2R2
fIPrQm7vMKSmXNPOFd90C3O176PR5H8n5UdL8VOG6olMc84e0KdcLygYHCxBWmv4
oimjd5HDiYogRr9ykZhvBPTCzXW17C/1BJWboj8kDxHZxED4m5y+47ySaYrhTqSs
KZh2A0Oz9MW46JBUSdU8rcGBSp2V12NnZ5yidvDHYB9l2nZOP7ugwOPR0C4x9cgc
vsKoWcMvCXd8MOdfdzlH8ltcbFuKZfQRJWZqNQWM0Jb+iV2KPYT0+citv9Q+CQGX
wuR9WiMb4aEn8ix0Q6SkYBthobYlSFtZaSodk4MH20UdAhsHwGBqZxs+wJTf45MF
Gq0Dt8fGz08JgepSNibmCCh4zQJjveMHvX/Cg3IfymoPvdAbXwEZuxeJrBS6l1RW
10t6Q8PPgmO+vi/FShfmwFlF0vbt+2fJj6NxkmXfHdempX/R0BEEo6z+RY5eRdfs
RUbzxqA6846Lz7UKSYuWbhETXaPphKpC7dGkohiteoItI51cpIRCUeZCqpwb1mrW
vt1xhgn9GMuTDzjgNuZuFhF/eHZTVwywvOBeOaiTCAXfSkeffpwgTA1fo93AG0P0
ny2GJEThicKaqBS/B8xlmPULBn+WE/90Btre6LWkfuLuqTPsJM0kRnAQPXyuBeHC
Cm9siDvciD4=
=B9Gw
-----END PGP SIGNATURE-----