Deserialization of untrusted data in FasterXML jackson-databind

CRITICAL 9.8CVE-2019-14379 · GHSA-6fpp-rgj9-8rwc · Published 29/07/2019 · updated 08/10/2026

In short

CVE-2019-14379 is a CRITICAL (CVSS 9.8) vulnerability affecting com.fasterxml.jackson.core:jackson-databind, xcode (apple), jackson-databind (fasterxml).
Chance of exploitation in the next 30 days (EPSS): 8.1%, higher than 94.8% of all vulnerabilities.
Fix: update to 2.8.11.4, 2.9.9.2, 2.7.9.6, 13.3 or later.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databind Maven	`≥ 2.8.0, < 2.8.11.4≥ 2.9.0, < 2.9.9.2< 2.7.9.6`	`2.8.11.42.9.9.22.7.9.6`
xcode apple	`< 13.3`	`13.3`
jackson-databind fasterxml	`≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.7.9.6≥ 2.8.0, < 2.8.11.4≥ 2.9.0, < 2.9.9.2`	`2.6.7.32.7.9.62.8.11.42.9.9.2`
active iq unified manager netapp	`≥ 7.3≥ 9.5`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.7.0= 2.7.1`	No fix yet
communications diameter signaling router oracle	`= 8.0.0= 8.1= 8.2= 8.2.1`	No fix yet
communications instant messaging server oracle	`= 10.0.1.3.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.2, ≤ 8.0.8`	No fix yet
goldengate stream analytics oracle	`< 19.1.0.0.1`	`19.1.0.0.1`
jd edwards enterpriseone orchestrator oracle	`= 9.2`	No fix yet
jd edwards enterpriseone tools oracle	`= 9.2`	No fix yet
primavera gateway oracle	`= 15.2= 16.2= 17.12= 18.8.0`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8≥ 17.7, ≤ 17.12`	No fix yet
retail customer management and segmentation foundation oracle	`= 17.0`	No fix yet
retail xstore point of service oracle	`= 15.0= 16.0= 17.0= 18.0= 7.1`	No fix yet
siebel engineering - installer & deployment oracle	`≤ 19.8`	No fix yet
siebel ui framework oracle	`≤ 19.10`	No fix yet
jboss enterprise application platform redhat	`= 7.2= 7.3`	No fix yet
openshift container platform redhat	`= 3.11= 4.1`	No fix yet
single sign-on redhat	`= 7.3`	No fix yet

Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

NVD description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

References

More vulnerabilities in com.fasterxml.jackson.core:jackson-databind

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free