Red Hat Product Errata RHSA-2019:1820 - Security Advisory

Issued:: 2019-07-22
Updated:: 2019-07-22

RHSA-2019:1820 - Security Advisory

Overview
Updated Packages

Synopsis

Important: rh-maven35-jackson-databind security update

Type/Severity

Security Advisory: Important

Topic

An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API.

Security Fix(es):

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.7 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.7 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.7 ppc64le
Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.6 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.6 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.6 ppc64le
Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.5 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.5 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.5 ppc64le
Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.4 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.4 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.4 ppc64le
Red Hat Software Collections (for RHEL Server) 1 for RHEL 7 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7 ppc64le
Red Hat Software Collections (for RHEL Server for ARM) 1 aarch64
Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7 x86_64

Fixes

BZ - 1725807 - CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

CVEs

CVE-2019-12384

References

https://access.redhat.com/security/updates/classification/#important

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
x86_64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
s390x
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
ppc64le
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.6

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
x86_64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.6

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
s390x
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.6

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
ppc64le
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.5

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
x86_64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.5

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
s390x
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.5

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
ppc64le
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.4

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
x86_64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.4

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
s390x
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.4

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
ppc64le
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
x86_64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
s390x
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
ppc64le
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Server for ARM) 1

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
aarch64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7

SRPM
rh-maven35-jackson-databind-2.7.6-2.6.el7.src.rpm	SHA-256: fdf21c61d56962f5ac8a86bf46bc1be66f1699d347af111a914edcfdda45aaa3
x86_64
rh-maven35-jackson-databind-2.7.6-2.6.el7.noarch.rpm	SHA-256: 133a5c766650afcb3ff87df5cd2e2b45b5c850a3abc4ed478c65ea7212ac0897
rh-maven35-jackson-databind-javadoc-2.7.6-2.6.el7.noarch.rpm	SHA-256: ec73d854bc1245ffdb74008dfcccbdf54d735b08b6153020360634e675685b3d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.