XML external entity flaw threatens integrity in Red Hat jackson-mapper-asl

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

• org.codehaus.jackson:jackson-mapper-asl in the 1.9.x line is marked affected in the normalized record.
• Red Hat records that Red Hat Single Sign-On 7.3.3 shipped jackson-mapper-asl-1.9.13.redhat-4.jar and was considered affected; the issue was addressed in Red Hat Single Sign-On 7.3.8.
• Red Hat records that the issue was addressed for Red Hat JBoss Enterprise Application Platform 7.2 on RHEL 6, RHEL 7, and RHEL 8, and for Red Hat JBoss Enterprise Application Platform 7.3 on RHEL 6, RHEL 7, and RHEL 8, through the corresponding errata.
• Red Hat records that the issue was addressed in Red Hat Fuse 7.7.0, EAP-CD 20 Tech Preview, and Red Hat Data Grid 7.3.7.
• For Debian 8 Jessie, the libjackson-json-java package was fixed in 1.9.2-3+deb8u1. For Debian buster, the package was fixed in 1.9.13-2~deb10u1.
• Red Hat marked Red Hat Mobile Application Platform and some JBoss 6 products outside the security-support scope for this issue; that status should not be interpreted as proof that the products were unaffected. Other branches, distributions, and bundled copies not listed here require separate verification.

The weakness is CWE-611 in org.codehaus.jackson:jackson-mapper-asl, where XML external entity processing is not sufficiently restricted in affected classes. An attacker can reach the issue only through an application path that accepts or otherwise processes attacker-influenced XML with the vulnerable library; the supplied assessment models this path as network-reachable, unauthenticated, and not requiring user interaction. The record does not identify exact classes, endpoints, XML formats, or surrounding application configuration, so exposure cannot be inferred from the presence of the JAR alone. The flaw is described as similar to an earlier XXE issue but affecting different classes. Available Debian package change notes describe enabling secure XML processing and disabling entity expansion as part of the fix, supporting the interpretation that entity expansion control is the relevant implementation boundary.

The assessed path is network-reachable, has low attack complexity, requires no privileges, and does not require user interaction. The practical precondition is still an application or service path that feeds attacker-influenced XML into the affected library. The record does not confirm active exploitation, a public exploit, or ransomware use; those statuses are unknown rather than negative. Uses that process only trusted, internal XML are not established as exposed.

Successful exploitation could allow attacker-influenced XML entity processing to affect application data or processing results, undermining application integrity. The supplied assessment records high integrity impact but does not record confidentiality or availability impact. The practical outcome depends on the calling code, parser configuration, and data handled by the application. The record does not establish file disclosure, SSRF, code execution, or denial of service, so those outcomes should not be assumed.

If a service can pass externally controlled XML into an affected processing path, application-controlled data or trusted processing results may be altered. Operational work may include reviewing Java applications, application servers, and Red Hat products that package copies of the library, then applying branch-specific updates. The supplied assessment identifies an integrity impact but does not identify confidentiality or availability impact. The record provides no evidence of a confirmed data disclosure, service outage, or specific breach.

1. Update the package or product to the appropriate fixed release for the deployment. For Debian 8 Jessie, use libjackson-json-java 1.9.2-3+deb8u1. For Debian buster, use libjackson-json-java 1.9.13-2~deb10u1.
2. For Red Hat products, apply the applicable vendor errata for Red Hat JBoss Enterprise Application Platform 7.2 or 7.3, Red Hat Single Sign-On 7.3.8, Red Hat Fuse 7.7.0, EAP-CD 20 Tech Preview, and Red Hat Data Grid 7.3.7 when those products are deployed.
3. Debian package change notes identify enabling Secure Processing on DocumentBuilderFactory and setting setExpandEntityReferences(false) as part of the fix. Do not assume these details are a substitute for a vendor-supported update in every other package or product.
4. The evidence does not establish one standalone upstream fixed release that can be used as a universal boundary for the entire org.codehaus.jackson:jackson-mapper-asl 1.9.x line. If a supported update is not yet available, restrict affected XML-processing paths from untrusted network input where operationally possible as interim containment and obtain product-specific guidance.
5. After updating, verify the artifact actually loaded by the runtime, review embedded JAR copies, and retest every service that processes externally supplied XML.

1. Inventory direct and transitive Java dependencies, including copies of jackson-mapper-asl embedded in application servers or product JARs.
2. Compare the artifact loaded at runtime with the affected and remediated branches listed in affected_summary; do not rely only on package-manager state.
3. Identify application paths that use jackson-mapper-asl to process XML and determine whether the XML can be supplied or modified by an untrusted source.
4. Review runtime parser behavior and configuration, especially controls that restrict external entities and entity expansion.
5. As a precaution, review application and request logs for unusual XML-processing errors or entity-related failures, but no specific IOC or log signature is established for this issue. The absence of such log evidence does not prove that a system is safe.