CVE-2019-17531 @ Maven-com.fasterxml.jackson.core:jackson-databind-2.8.9

[margaritalm]

Checkmarx (SCA): Vulnerable Package
Vulnerability: Read More about CVE-2019-17531
Checkmarx Project: margaritalm/BookStore_Small_CLI_small
Repository URL: https://github.com/margaritalm/BookStore_Small_CLI_small
Branch: master
Scan ID: 79dde67e-447e-480d-9f9e-f0bfb2e3e6f8

---

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.7.9.7, 2.8.x up to 2.8.11.4 and 2.9.x up to 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.8.11.3-redhat-00001