CVE-2019-14379Critical· 9.8▾ MidnightSubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 1.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
8.1%
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
jackson-databind >= 2.0.0, < 2.6.7.3jackson-databind >= 2.7.0, < 2.7.9.6jackson-databind >= 2.8.0, < 2.8.11.4jackson-databind >= 2.9.0, < 2.9.9.2debian_linux = 8.0active_iq_unified_manager >= 7.3active_iq_unified_manager >= 9.5oncommand_workflow_automationservice_level_managersnapcenterfedora = 29fedora = 30fedora = 31jboss_enterprise_application_platform = 7.2jboss_enterprise_application_platform = 7.3openshift_container_platform = 4.1single_sign-on = 7.3openshift_container_platform = 3.11banking_platform = 2.4.0banking_platform = 2.4.1banking_platform = 2.5.0banking_platform = 2.6.0banking_platform = 2.6.1banking_platform = 2.7.0banking_platform = 2.7.1communications_diameter_signaling_router = 8.0.0communications_diameter_signaling_router = 8.1communications_diameter_signaling_router = 8.2communications_diameter_signaling_router = 8.2.1communications_instant_messaging_server = 10.0.1.3.0financial_services_analytical_applications_infrastructure >= 8.0.2, <= 8.0.8goldengate_stream_analytics < 19.1.0.0.1jd_edwards_enterpriseone_orchestrator = 9.2jd_edwards_enterpriseone_tools = 9.2primavera_gateway = 15.2primavera_gateway = 16.2primavera_gateway = 17.12primavera_gateway = 18.8.0primavera_unifier >= 17.7, <= 17.12primavera_unifier = 16.1primavera_unifier = 16.2primavera_unifier = 18.8retail_customer_management_and_segmentation_foundation = 17.0retail_xstore_point_of_service = 7.1retail_xstore_point_of_service = 15.0retail_xstore_point_of_service = 16.0retail_xstore_point_of_service = 17.0retail_xstore_point_of_service = 18.0siebel_engineering_-_installer_&_deployment <= 19.8siebel_ui_framework <= 19.10xcode < 13.3Upgrade past the affected range:
jackson-databind 2.9.9.2goldengate_stream_analytics 19.1.0.0.1xcode 13.3Connected by shared product, vendor, weakness, or advisory.
CVE-2018-12023High· 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6
CVE-2018-19362Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CVE-2018-14721Critical· 10.0FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVE-2018-19360Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-19361Critical· 9.8FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-14720Critical· 9.8FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.