CVE-2019-10202 Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl

What is CVE-2019-10202?

CVE-2019-10202 is a high-severity unsafe deserialization vulnerability in Redhat Jboss Enterprise Application Platform, published on 1 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Weakness: CWE-502

Which versions are affected by CVE-2019-10202?

2 open source packages ship an affected version, including org.codehaus.jackson:jackson-mapper-asl. It affects 1 product.

Products include Redhat Jboss Enterprise Application Platform.

How do I fix CVE-2019-10202?

Apply the vendor's patch.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2019-10202 being exploited?

There is no known exploitation of CVE-2019-10202 in the wild and no public exploit code.

Other vulnerabilities in Redhat Jboss Enterprise Application Platform

• CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution Exploited Critical 9.8
• CVE-2010-1428 Red Hat JBoss Information Disclosure Exploited Medium 5.9
• CVE-2010-0738 Red Hat JBoss Authentication Bypass Exploited Low 3.7
• CVE-2016-3690 Deserialization in n/a Critical 9.8
• CVE-2017-7504 Deserialization in JBoss Critical 9.8

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c27h-mcmw-48hv, ROOT-APP-MAVEN-CVE-2019-10202.