Stay Secure with the Latest Linux Advisories

security advisorysecurity issueupdate

Fedora 30: FEDORA-2019-ae6a703b8f Security Alert on jackson-annotations

- Update jackson-databind to version 2.9.9.3. - Update jackson-core to version 2.9.9. - Update jackson-annotations to version 2.9.9. - Update jackson-bom to version 2.9.9. Resolves CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, and CVE-14439.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-ae6a703b8f 2019-09-22 02:25:03.365504 --------------------------------------------------------------------------------Name : jackson-annotations Product : Fedora 30 Version : 2.9.9 Release : 1.fc30 URL : https://github.com/FasterXML/jackson-annotations/ Summary : Core annotations for Jackson data processor Description : Core annotations used for value types, used by Jackson data-binding package. --------------------------------------------------------------------------------Update Information: - Update jackson-databind to version 2.9.9.3. - Update jackson-core to version 2.9.9. - Update jackson-annotations to version 2.9.9. - Update jackson-bom to version 2.9.9. Resolves CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, and CVE-14439. --------------------------------------------------------------------------------ChangeLog: * Thu Sep 12 2019 Alexander Scheel - 2.9.9-1 - Update to latest upstream release --------------------------------------------------------------------------------References: [ 1 ] Bug #1737518 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1737518 [ 2 ] Bug #1725808 - CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1725808 [ 3 ] Bug #1725796 - CVE-2019-12814 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server viacrafted JSON message. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1725796 [ 4 ] Bug #1713469 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1713469 [ 5 ] Bug #1752964 - CVE-2019-14439 jackson-databind: Polymorphic typing issue related to logback/JNDI [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1752964 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-ae6a703b8f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Address severe vulnerabilities in jackson-annotations through this Fedora security patch outlining potential remote execution threats.. jackson-annotations update, Fedora security, remote code execution, jackson-databind fix. . Severity: Critical. LinuxSecurity.com Team

Sep 21, 2019 •Critical Fedora