cbcvebase.
CVE-2019-14892
published 2020-03-02

CVE-2019-14892: A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious…

critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Affected

18 ranges
VendorProductVersion rangeFixed in
apachegeode
debianjackson-databind< jackson-databind 2.10.0-1 (bookworm)jackson-databind 2.10.0-1 (bookworm)
fasterxmljackson-databind>= 0 < 2.10.0-12.10.0-1
fasterxmljackson-databind>= 0 < 2.10.0-12.10.0-1
fasterxmljackson-databind>= 0 < 2.10.0-12.10.0-1
fasterxmljackson-databind>= 0 < 2.10.0-12.10.0-1
fasterxmljackson-databind>= 2.0.0 < 2.6.7.32.6.7.3
fasterxmljackson-databind>= 2.7.0 < 2.8.11.52.8.11.5
fasterxmljackson-databind>= 2.9.0 < 2.9.102.9.10
red_hatjackson-databind
red_hatjackson-databind
red_hatjackson-databind
redhatdecision_manager
redhatjboss_data_grid
redhatjboss_enterprise_application_platform
redhatjboss_fuse
redhatopenshift_container_platform
redhatprocess_automation

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL