NetSight
IP …
critical9.8

CVE-2019-14379

Deserialization of untrusted data in FasterXML jackson-databind

Impact

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.9.0, < 2.9.9.22.9.9.2

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.0.0 before 2.6.7.3
from 2.7.0 before 2.7.9.6
from 2.8.0 before 2.8.11.4
from 2.9.0 before 2.9.9.2
DebianDebian Linux
Version 8.0
NetappActive Iq Unified Manager
from 7.3
from 9.5
NetappOncommand Workflow Automation
All versions
NetappService Level Manager
All versions
NetappSnapcenter
All versions
FedoraprojectFedora
Versions 29, 30, 31
RedhatJboss Enterprise Application Platform
Versions 7.2, 7.3
RedhatOpenshift Container Platform
Versions 4.1, 3.11
RedhatSingle Sign-On
Version 7.3
OracleBanking Platform
Versions 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0
OracleCommunications Diameter Signaling Router
Versions 8.0.0, 8.1, 8.2, 8.2.1

Weakness classification

CWE-1321CWE-915

References