RHSA-2020:0729HighCVSS 7.5

Red Hat Security Advisory: Red Hat Data Grid 7.3.5 security update

Published
March 5, 2020
Last Modified
November 5, 2026

🔗 CVE IDs covered (5)

CVE-2019-14893 →CVE-2019-16335 →CVE-2015-9251 →CVE-2019-14888 →CVE-2019-14892 →

📋 Description

CVE-2015-9251 — jquery: Cross-site scripting via cross-domain ajax requests CVE-2019-14888 — undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS CVE-2019-14892 — jackson-databind: Serialization gadgets in classes of the commons-configuration package CVE-2019-14893 — jackson-databind: Serialization gadgets in classes of the xalan package CVE-2019-16335 — jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

🎯 Affected products1

  • Red Hat Data Grid 7.3.5

✅ Remediation

To install this update, do the following: 1. Download the Data Grid 7.3.5 server patch from the customer portal. 2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on. 3. Install the Data Grid 7.3.5 server patch. Refer to the 7.3 Release Notes for patching instructions. 4. Restart Data Grid to ensure the changes take effect. Workaround: Enable HTTP2 (enable-http2="true") in the undertow's HTTPS settings. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: This vulnerability relies on com.zaxxer.hikari.HikariDataSource being present in the application's ClassPath. Hikari is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use com.zaxxer.hikari are not impacted by this vulnerability. A mitigation to this class of problem in jackson-databind is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (10)