中危 Jackson XXE CVE-2019-12814

CVE编号

CVE-2019-12814

利用情况

EXP 已公开

补丁情况

官方补丁

披露时间

2019-06-20
该漏洞EXP已公开传播,漏洞利用成本极低,建议您立即关注并修复。
漏洞描述
FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。jackson-databind是其中的一个具有数据绑定功能的组件。
在FasterXML jackson-databind 2.x到2.9.9中发现了多态键入问题。如果为外部公开的JSON端点启用了“默认类型”(全局或特定属性),并且该服务在类路径中具有JDOM 1.x或2.x jar,则攻击者可以发送特制的JSON消息,使他们能够读取服务器上的任意本地文件。

解决建议
厂商已发布了漏洞修复程序,请及时关注更新:
https://github.com/FasterXML/jackson-databind/issues/2341
参考链接
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:2935
https://access.redhat.com/errata/RHSA-2019:2936
https://access.redhat.com/errata/RHSA-2019:2937
https://access.redhat.com/errata/RHSA-2019:2938
https://access.redhat.com/errata/RHSA-2019:3044
https://access.redhat.com/errata/RHSA-2019:3045
https://access.redhat.com/errata/RHSA-2019:3046
https://access.redhat.com/errata/RHSA-2019:3050
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3200
https://access.redhat.com/errata/RHSA-2019:3292
https://access.redhat.com/errata/RHSA-2019:3297
https://github.com/FasterXML/jackson-databind/issues/2341
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9...
https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07...
https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed...
https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b...
https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5af...
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2d...
https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1...
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37...
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e8520684...
https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d79882...
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d...
https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f...
https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df...
https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244e...
https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f85...
https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5...
https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938...
https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a6...
https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79c...
https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1...
https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214...
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a...
https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44...
https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d9...
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec...
https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2...
https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f6...
https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284e...
https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b...
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34...
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be1...
https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...
https://security.netapp.com/advisory/ntap-20190625-0006/
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 fasterxml jackson-databind * From
(including)
2.7.0
Up to
(including)
2.7.9.5
运行在以下环境
应用 fasterxml jackson-databind * From
(including)
2.8.0
Up to
(including)
2.8.11.3
运行在以下环境
应用 fasterxml jackson-databind * From
(including)
2.9.0
Up to
(excluding)
2.9.9.1
运行在以下环境
系统 debian_10 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 debian_11 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 debian_12 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 fedora_29 jackson-annotations * Up to
(excluding)
2.9.9-1.fc29
运行在以下环境
系统 fedora_30 jackson-annotations * Up to
(excluding)
2.9.9-1.fc30
运行在以下环境
系统 fedora_31 jackson-annotations * Up to
(excluding)
2.9.9-1.fc31
运行在以下环境
系统 ubuntu_20.04 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 ubuntu_21.04 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 ubuntu_21.10 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 ubuntu_22.04 jackson-databind * Up to
(excluding)
2.9.8-3
运行在以下环境
系统 ubuntu_22.10 jackson-databind * Up to
(excluding)
2.9.8-3
阿里云评分
4.5
  • 攻击路径
    远程
  • 攻击复杂度
    复杂
  • 权限要求
    无需权限
  • 影响范围
    有限影响
  • EXP成熟度
    EXP 已公开
  • 补丁情况
    官方补丁
  • 数据保密性
    数据泄露
  • 数据完整性
    传输被破坏
  • 服务器危害
    无影响
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-502 可信数据的反序列化
阿里云安全产品覆盖情况