CVE-2019-14892
published 2020-03-02CVE-2019-14892: A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious…
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | geode | — | — |
| debian | jackson-databind | < jackson-databind 2.10.0-1 (bookworm) | jackson-databind 2.10.0-1 (bookworm) |
| fasterxml | jackson-databind | >= 0 < 2.10.0-1 | 2.10.0-1 |
| fasterxml | jackson-databind | >= 0 < 2.10.0-1 | 2.10.0-1 |
| fasterxml | jackson-databind | >= 0 < 2.10.0-1 | 2.10.0-1 |
| fasterxml | jackson-databind | >= 0 < 2.10.0-1 | 2.10.0-1 |
| fasterxml | jackson-databind | >= 2.0.0 < 2.6.7.3 | 2.6.7.3 |
| fasterxml | jackson-databind | >= 2.7.0 < 2.8.11.5 | 2.8.11.5 |
| fasterxml | jackson-databind | >= 2.9.0 < 2.9.10 | 2.9.10 |
| red_hat | jackson-databind | — | — |
| red_hat | jackson-databind | — | — |
| red_hat | jackson-databind | — | — |
| redhat | decision_manager | — | — |
| redhat | jboss_data_grid | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_fuse | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | process_automation | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL