CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-502, CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:geode
- fasterxml:jackson-databind
- redhat:decision_manager
- redhat:jboss_data_grid
- redhat:jboss_enterprise_application_platform
- redhat:jboss_fuse
- redhat:openshift_container_platform
- redhat:process_automation
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cf6r-3wgc-h863 | Maven | com.fasterxml.jackson.core:jackson-databind | <2.6.7.3 | 2.6.7.3 |
| GHSA-cf6r-3wgc-h863 | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.7.0 <2.8.11.5 | 2.8.11.5 |
| GHSA-cf6r-3wgc-h863 | Maven | com.fasterxml.jackson.core:jackson-databind | >=2.9.0 <2.9.10 | 2.9.10 |
References
- https://access.redhat.com/errata/RHSA-2020:0729
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892
- https://github.com/FasterXML/jackson-databind/issues/2462
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E