CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2019-10172
High (7.5). EPSS 17% chance of exploitation in the next 30 days.
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Severity
- EPSS
- 17% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-11-01)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:spark
- debian:debian_linux
- fasterxml:jackson-mapper-asl
- redhat:jboss_enterprise_application_platform
- redhat:jboss_fuse
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r6j9-8759-g62w | Maven | org.codehaus.jackson:jackson-mapper-asl | <=1.9.13 | no fix published |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172
- https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E