CVE-2019-14379

Published: Jul 29, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Affected (52)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Netapp: Active Iq Unified Manager, Oncommand Workflow Automation, Service Level Manager, Snapcenter · +4 more

Show all products

1 product

1 product

4 products

Active Iq Unified Manager

Oncommand Workflow Automation

Service Level Manager

1 product

3 products

Openshift Container Platform

Jboss Enterprise Application Platform

Single Sign On

Oracle

13 products

Banking Platform

Communications Diameter Signaling Router

Communications Instant Messaging Server

Financial Services Analytical Applications Infrastructure

Goldengate Stream Analytics

Jd Edwards Enterpriseone Orchestrator

Jd Edwards Enterpriseone Tools

Primavera Gateway

Primavera Unifier

Retail Customer Management And Segmentation Foundation

Retail Xstore Point Of Service

Siebel Engineering Installer & Deployment

Siebel Ui Framework

Apple

1 product

Xcode

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.0.0 to 2.6.7.3
Fasterxml Jackson Databind	From 2.7.0 to 2.7.9.6
Fasterxml Jackson Databind	From 2.8.0 to 2.8.11.4
Fasterxml Jackson Databind	From 2.9.0 to 2.9.9.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 7.3
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Oncommand Workflow Automation	All versions
Netapp Service Level Manager	All versions
Netapp Snapcenter	All versions

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 4.1

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 7.0

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 3.11

Configuration G

1 platform

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0

Configuration H

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.2
Redhat Jboss Enterprise Application Platform	Version 7.3
Redhat Single Sign On	Version 7.3

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 8.0

Configuration I

32 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	Version 2.4.0
Oracle Banking Platform	Version 2.4.1
Oracle Banking Platform	Version 2.5.0
Oracle Banking Platform	Version 2.6.0
Oracle Banking Platform	Version 2.6.1
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Communications Diameter Signaling Router	Version 8.0.0
Oracle Communications Diameter Signaling Router	Version 8.1
Oracle Communications Diameter Signaling Router	Version 8.2.1
Oracle Communications Diameter Signaling Router	Version 8.2
Oracle Communications Instant Messaging Server	Version 10.0.1.3.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.2 to 8.0.8
Oracle Goldengate Stream Analytics	Before 19.1.0.0.1
Oracle Jd Edwards Enterpriseone Orchestrator	Version 9.2
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Primavera Gateway	Version 15.2
Oracle Primavera Gateway	Version 16.2
Oracle Primavera Gateway	Version 17.12
Oracle Primavera Gateway	Version 18.8.0
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 16.1
Oracle Primavera Unifier	Version 16.2
Oracle Primavera Unifier	Version 18.8
Oracle Retail Customer Management And Segmentation Foundation	Version 17.0
Oracle Retail Xstore Point Of Service	Version 15.0
Oracle Retail Xstore Point Of Service	Version 16.0
Oracle Retail Xstore Point Of Service	Version 17.0
Oracle Retail Xstore Point Of Service	Version 18.0
Oracle Retail Xstore Point Of Service	Version 7.1
Oracle Siebel Engineering Installer & Deployment	Up to 19.8
Oracle Siebel Ui Framework	Up to 19.10

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Apple Xcode	Before 13.3

Related CWEs

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (118)

http://seclists.org/fulldisclosure/2022/Mar/23

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHBA-2019:2824

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2743

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2935

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2936

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2937

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2938

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2998

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3044

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3045

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3046

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3050

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3200

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3292

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3297

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3901

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0727

Source: cve@mitre.org

Third Party Advisory

https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/FasterXML/jackson-databind/issues/2387

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb%40%3Ccommits.pulsar.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d%40%3Cissues.iceberg.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a%40%3Ccommits.ambari.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20190814-0001/

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT213189

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cve@mitre.org

PatchThird Party Advisory

http://seclists.org/fulldisclosure/2022/Mar/23