Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv3

CVE-2019-14439

Published: 30/07/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Jackson-databind

Vulnerability Summary

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.x prior to 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

fasterxml jackson-databind

debian debian linux 8.0

debian debian linux 9.0

debian debian linux 10.0

fedoraproject fedora 29

fedoraproject fedora 30

apache drill 1.16.0

redhat jboss middleware text-only advisories 1.0

oracle retail xstore point of service 15.0

oracle banking platform 2.4.0

oracle retail xstore point of service 7.1

oracle jd edwards enterpriseone tools 9.2

oracle banking platform 2.4.1

oracle primavera gateway 16.1

oracle primavera gateway 16.2

oracle primavera gateway 15.2

oracle banking platform 2.5.0

oracle retail xstore point of service 16.0

oracle jd edwards enterpriseone orchestrator 9.2

oracle banking platform 2.6.0

oracle banking platform 2.6.1

oracle retail customer management and segmentation foundation 17.0

oracle siebel ui framework

oracle retail xstore point of service 17.0

oracle retail xstore point of service 18.0

oracle global lifecycle management opatch

oracle banking platform 2.7.0

oracle banking platform 2.7.1

oracle goldengate stream analytics

oracle communications diameter signaling router 8.2.1

oracle communications diameter signaling router 8.0.0

oracle communications diameter signaling router 8.1

oracle communications diameter signaling router 8.2

oracle financial services analytical applications infrastructure

oracle primavera gateway

oracle primavera gateway 18.8.0

oracle siebel engineering - installer \\& deployment

oracle communications instant messaging server 10.0.1.3.0

oracle global lifecycle management opatch 13.9.4.2.1

oracle global lifecycle management opatch 11.2.0.3.23

Vendor Advisories

Red Hat: Important: Red Hat Fuse 7.6.0 security update
Synopsis Important: Red Hat Fuse 760 security update Type/Severity Security Advisory: Important Topic A minor version update (from 75 to 76) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Product Security h ...
Red Hat: Moderate: Red Hat AMQ Streams 1.3.0 release and security update
Synopsis Moderate: Red Hat AMQ Streams 130 release and security update Type/Severity Security Advisory: Moderate Topic Red Hat AMQ Streams 130 is now available from the Red Hat Customer PortalRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability ...
Debian Security Advisories: DSA-4542-1 jackson-databind -- security update
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server For the oldstable distribution (stretch), these prob ...
Hitachi Security Advisories: Multiple Vulnerabilities in Cosminexus
Cosminexus Component Container contain the following vulnerabilities: CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-14892, CVE-2019-14893, CVE-2019-16335, CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2020-8840, CVE-2020-9546, CVE-2020-9547, CVE-20 ...
Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Analyzer viewpoint
Multiple vulnerabilities have been found in Hitachi Ops Center Analyzer viewpoint CVE-2018-10054, CVE-2018-14335, CVE-2018-20200, CVE-2019-10086, CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, CVE-2019-14439, CVE-2019-14540, CVE-2019-14892, CVE-2019-14893, CVE-2019-16335, CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, CVE-2019- ...

Github Repositories

https://github.com/heike2718/commons

commonly used classes and functionality

commons commonly used classes and functionality Releases 420 common API for serverside loggs of client errors 410 moved RefreshAccessTokenPayload to authprovider 401 CVE-2019-14379, CVE-2019-14439 400 refreshToken aus Client-Authentisierung entfernt Es genügt ein kurzzeitig gültiges accessToken, welches über Server-Server-Kommunikation mittels ClientSecr

https://github.com/jas502n/CVE-2019-14439

Jackson-databind RCE

CVE-2019-14439 Jackson-databind RCE

References

CWE-502https://github.com/FasterXML/jackson-databind/issues/2389https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125bhttps://lists.debian.org/debian-lts-announce/2019/08/msg00011.htmlhttps://security.netapp.com/advisory/ntap-20190814-0001/https://www.debian.org/security/2019/dsa-4542https://seclists.org/bugtraq/2019/Oct/6https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://access.redhat.com/errata/RHSA-2019:3200https://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3Ehttps://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3Ehttps://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3Ehttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2020:0983https://nvd.nist.govhttps://github.com/heike2718/commonshttps://www.debian.org/security/2019/dsa-4542
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2006-4304CVE-2024-4240arbitrary CVE-2024-31601XSSCVE-2023-20198CVE-2024-4256CVE-2024-3342encryption
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook