CVE-2019-14439

Published: Jul 30, 2019Modified: Oct 8, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Affected (45)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Fedoraproject: Fedora · +3 more

Show all products

1 product

1 product

1 product

1 product

1 product

Jboss Middleware Text Only Advisories

Oracle

13 products

Banking Platform

Communications Diameter Signaling Router

Communications Instant Messaging Server

Financial Services Analytical Applications Infrastructure

Global Lifecycle Management Opatch

Goldengate Stream Analytics

Jd Edwards Enterpriseone Orchestrator

Jd Edwards Enterpriseone Tools

Primavera Gateway

Retail Customer Management And Segmentation Foundation

Retail Xstore Point Of Service

Siebel Engineering Installer & Deployment

Siebel Ui Framework

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	2.0.0 ≤ version < 2.6.7.3
Fasterxml Jackson Databind	2.7.0 ≤ version < 2.7.9.6
Fasterxml Jackson Databind	2.8.0 ≤ version < 2.8.11.4
Fasterxml Jackson Databind	2.9.0 ≤ version < 2.9.9.2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Apache Drill	Version 1.16.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Middleware Text Only Advisories	Version 1.0

Configuration F

34 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	Version 2.4.0
Oracle Banking Platform	Version 2.4.1
Oracle Banking Platform	Version 2.5.0
Oracle Banking Platform	Version 2.6.0
Oracle Banking Platform	Version 2.6.1
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Communications Diameter Signaling Router	Version 8.0.0
Oracle Communications Diameter Signaling Router	Version 8.1
Oracle Communications Diameter Signaling Router	Version 8.2.1
Oracle Communications Diameter Signaling Router	Version 8.2
Oracle Communications Instant Messaging Server	Version 10.0.1.3.0
Oracle Financial Services Analytical Applications Infrastructure	8.0.2 ≤ version ≤ 8.0.8
Oracle Global Lifecycle Management Opatch	version < 11.2.0.3.23
Oracle Global Lifecycle Management Opatch	12.2.0.1.0 ≤ version < 12.2.0.1.19
Oracle Global Lifecycle Management Opatch	13.9.4.0.0 ≤ version < 13.9.4.2.1
Oracle Global Lifecycle Management Opatch	Version 11.2.0.3.23
Oracle Global Lifecycle Management Opatch	Version 13.9.4.2.1
Oracle Goldengate Stream Analytics	version < 19.1.0.0.1
Oracle Jd Edwards Enterpriseone Orchestrator	Version 9.2
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Primavera Gateway	17.7 ≤ version ≤ 17.12
Oracle Primavera Gateway	Version 15.2
Oracle Primavera Gateway	Version 16.1
Oracle Primavera Gateway	Version 16.2
Oracle Primavera Gateway	Version 18.8.0
Oracle Retail Customer Management And Segmentation Foundation	Version 17.0
Oracle Retail Xstore Point Of Service	Version 15.0
Oracle Retail Xstore Point Of Service	Version 16.0
Oracle Retail Xstore Point Of Service	Version 17.0
Oracle Retail Xstore Point Of Service	Version 18.0
Oracle Retail Xstore Point Of Service	Version 7.1
Oracle Siebel Engineering Installer & Deployment	version ≤ 19.8
Oracle Siebel Ui Framework	version ≤ 19.10

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (58)

https://access.redhat.com/errata/RHSA-2019:3200

Source: cve@mitre.org

Third Party Advisory

https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b

Source: cve@mitre.org

Patch

https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2

Source: cve@mitre.org

PatchProduct

https://github.com/FasterXML/jackson-databind/issues/2389

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Oct/6

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20190814-0001/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4542

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cve@mitre.org

PatchThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:3200