CVE-2019-12384Medium· 5.9▾ TwilightPoC availableFasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code exec…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
45%
2 GitHub repos (last check)
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
jackson-databind >= 2.0.0, < 2.6.7.3jackson-databind >= 2.7.0, < 2.7.9.6jackson-databind >= 2.8.0, < 2.8.11.4jackson-databind >= 2.9.0, < 2.9.9.1debian_linux = 8.0enterprise_linux = 7.0enterprise_linux = 7.4enterprise_linux = 7.5enterprise_linux = 7.6enterprise_linux = 7.7Upgrade past the affected range:
jackson-databind 2.9.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2020-11113High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2018-7489Critical· 9.8FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw
CVE-2017-7525Critical· 9.8A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue meth…
CVE-2020-8840Critical· 9.8FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVE-2019-14540Critical· 9.8A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10
CVE-2019-14439High· 7.5A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2