Jackson-databind: Block one more gadget type (HikariCP, CVE-2019-14540)

[iSafeBlue]

Another gadget (*) type report regarding HikariConfig, via HikariDataSource

Mitre id: CVE-2019-14540
Reporter: iSafeBlue / blue at ixsec.org

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

Fixed in:

• 2.9.10
• 2.8.11.5
• 2.6.7.3
• does not affect 2.10.0 and later

[Ramos-dev]

it also work find on fastjson.

[cowtowncoder]

Thank you for the report -- I got the email and had a look at linked to explanation.
Seems legit.

[jdelta-RBS]

maybe this one will get 3 CVEs : )

[cowtowncoder]

Block added, will be included in:

• 2.9.10
• 2.10.0.pr2 (and final 2.10.0)

also backported in 2.8 branch but not sure if any more releases for 2.8 will be made.

[OrangeDog]

When is 2.9.10 being released?
Looks like another repeat of the delay on the previous security fixes.

[cowtowncoder]

@OrangeDog 2.9.10 will be released after 2.10.0, likely in 2 weeks.

[jordandev]

No 2.9.9.4 micro patch for this?

[cowtowncoder]

Nope.