CVE-2019-10172 Improper Restriction of XML External Entity Reference in jackson-mapper-asl
HighCVSS 7.5
EPSS 17.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.codehaus.jackson/jackson-mapper-asl(Maven) | <= 1.9.13 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.7 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.8 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.9 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.9-2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.9-3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.9-4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.9-5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 0.9.9-6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.0.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.0.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.1.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.1.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.1.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.2.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.2.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.3.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.3.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.3.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.3.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.3.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.3.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.4.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.4.1 | No fix listed |
Show 68 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.4.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.4.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.4.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.4.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.7 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.5.8 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.7 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.6.9 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.7 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.8 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.7.9 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.10 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.11 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.7 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.8 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.8.9 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.0 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.1 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.10 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.11 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.12 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.13 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.2 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.3 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.4 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.5 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.6 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.7 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.8 | No fix listed |
| org.codehaus.jackson/jackson-mapper-asl(Maven) | = 1.9.9 | No fix listed |
| debian/libjackson-json-java(Debian:12) | < 1.9.13-2 | 1.9.13-2 |
| debian/libjackson-json-java(Debian:13) | < 1.9.13-2 | 1.9.13-2 |
| debian/libjackson-json-java(Debian:14) | < 1.9.13-2 | 1.9.13-2 |
| FasterXML jackson-mapper-asl | >= 1.9.0, <= 1.9.13 | No fix listed |
| redhat jboss enterprise application platform | = 7.0 | No fix listed |
| redhat jboss fuse | = 7.0.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| apache spark | = 3.0.1 | No fix listed |
| redhat/jackson-mapper-asl | = 1.9.x | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- [debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update mailing-list third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- [debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update mailing-list third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- [cassandra-commits] 20200420 [jira] [Updated] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [hadoop-common-issues] 20210320 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hadoop-common-issues] 20210907 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hadoop-common-issues] 20210921 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hive-issues] 20210318 [jira] [Comment Edited] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [hadoop-common-issues] 20210924 [jira] [Updated] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hive-issues] 20210318 [jira] [Updated] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [hadoop-common-issues] 20210906 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172 mailing-list
- [cassandra-commits] 20200407 [jira] [Created] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hive-issues] 20210729 [jira] [Resolved] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [cassandra-commits] 20200420 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [cassandra-commits] 20210926 [jira] [Commented] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172 mailing-list
- [cassandra-commits] 20200901 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [hadoop-common-issues] 20210920 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hadoop-user] 20210317 jackson-mapper-asl vulnerability at Hadoop mailing-list
- [hadoop-common-issues] 20200825 [jira] [Updated] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [cassandra-commits] 20200819 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172 mailing-list
- [hive-issues] 20210318 [jira] [Commented] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [hive-dev] 20210318 CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [cassandra-commits] 20210927 [jira] [Assigned] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172 mailing-list
- [spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries mailing-list
- [hive-issues] 20210318 [jira] [Assigned] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [cassandra-commits] 20200901 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [cassandra-commits] 20200413 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [hadoop-common-issues] 20210924 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [cassandra-commits] 20200420 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ? mailing-list
- [hadoop-common-issues] 20200825 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hive-dev] 20210318 [jira] [Created] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar mailing-list
- [hadoop-common-issues] 20210927 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172 mailing-list
- [cassandra-commits] 20200818 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172 mailing-list
- [cassandra-commits] 20200818 [jira] [Created] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172 mailing-list
- github.com
- Debian Security Tracker CVE-2019-10172 vendor-advisory