CVEvulnerability

CVE-2019-14439

7.5 HIGH Published 2019-07-30 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2019-07-30
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Affected configurations

• fasterxml jackson-databind (>= 2.0.0 < 2.6.7.3) • fasterxml jackson-databind (>= 2.7.0 < 2.7.9.6) • fasterxml jackson-databind (>= 2.8.0 < 2.8.11.4) • fasterxml jackson-databind (>= 2.9.0 < 2.9.9.2) • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • fedoraproject fedora 29 • fedoraproject fedora 30 • apache drill 1.16.0 • redhat jboss middleware text-only advisories 1.0 • oracle banking platform 2.4.0 • oracle banking platform 2.4.1 • oracle banking platform 2.5.0 • oracle banking platform 2.6.0 • oracle banking platform 2.6.1 • oracle banking platform 2.7.0 • oracle banking platform 2.7.1 • oracle communications diameter signaling router 8.0.0 • oracle communications diameter signaling router 8.1 • oracle communications diameter signaling router 8.2 • oracle communications diameter signaling router 8.2.1 • oracle communications instant messaging server 10.0.1.3.0 • oracle financial services analytical applications infrastructure (>= 8.0.2 <= 8.0.8) • oracle global lifecycle management opatch (< 11.2.0.3.23) • oracle global lifecycle management opatch (>= 12.2.0.1.0 < 12.2.0.1.19) • oracle global lifecycle management opatch (>= 13.9.4.0.0 < 13.9.4.2.1) • oracle global lifecycle management opatch 11.2.0.3.23 • oracle global lifecycle management opatch 13.9.4.2.1 • oracle goldengate stream analytics (< 19.1.0.0.1) • oracle jd edwards enterpriseone orchestrator 9.2 • oracle jd edwards enterpriseone tools 9.2 • oracle primavera gateway (>= 17.7 <= 17.12) • oracle primavera gateway 15.2 • oracle primavera gateway 16.1 • oracle primavera gateway 16.2 • oracle primavera gateway 18.8.0 • oracle retail customer management and segmentation foundation 17.0 • oracle retail xstore point of service 7.1 • oracle retail xstore point of service 15.0 • oracle retail xstore point of service 16.0 • oracle retail xstore point of service 17.0 • oracle retail xstore point of service 18.0 • oracle siebel engineering - installer \& deployment (<= 19.8) • oracle siebel ui framework (<= 19.10)

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References