Polymorphic Typing in FasterXML jackson-databind

CRITICAL 9.8CVE-2019-16942 · GHSA-mx7p-6679-8g3q · Published 01/10/2019 · updated 08/10/2026

In short

CVE-2019-16942 is a CRITICAL (CVSS 9.8) vulnerability affecting com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), active iq unified manager (netapp).
Chance of exploitation in the next 30 days (EPSS): 5.7%, higher than 93.0% of all vulnerabilities.
Fix: update to 2.6.7.3, 2.8.11.5, 2.9.10.1 or later.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databind Maven	`≥ 2.0.0, < 2.6.7.3≥ 2.7.0, < 2.8.11.5≥ 2.9.0, < 2.9.10.1`	`2.6.7.32.8.11.52.9.10.1`
jackson-databind fasterxml	`≥ 2.0.0, < 2.6.7.3≥ 2.8.0, < 2.8.11.5≥ 2.9.0, < 2.9.10.1`	`2.6.7.32.8.11.52.9.10.1`
active iq unified manager netapp	`≥ 7.3≥ 9.5`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.6.2= 2.7.0= 2.7.1= 2.9.0`	No fix yet
communications billing and revenue management oracle	`= 12.0.0.3.0= 7.5.0.23.0`	No fix yet
communications calendar server oracle	`= 8.0.0.2.0= 8.0.0.3.0`	No fix yet
communications cloud native core network slice selection function oracle	`= 1.2.1`	No fix yet
communications evolved communications application server oracle	`= 7.1`	No fix yet
database server oracle	`= 12.2.0.1= 18c= 19c`	No fix yet
global lifecycle management nextgen oui framework oracle	`= 12.2.1.3.0= 12.2.1.4.0= 13.9.4.2.2`	No fix yet
goldengate application adapters oracle	`= 19.1.0.0.0`	No fix yet
jd edwards enterpriseone orchestrator oracle	`= 9.2`	No fix yet
jd edwards enterpriseone tools oracle	`= 9.2`	No fix yet
primavera gateway oracle	`= 19.12.0≥ 17.12.0, ≤ 17.12.6≥ 18.8.0, ≤ 18.8.8`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12`	No fix yet
retail merchandising system oracle	`= 15.0.3= 16.0.2= 16.0.3`	No fix yet
retail sales audit oracle	`= 14.1`	No fix yet
siebel engineering - installer & deployment oracle	`≤ 2.20.5`	No fix yet
siebel ui framework oracle	`= 20.6≤ 20.5`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
webcenter sites oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
jboss enterprise application platform redhat	`= 7.2.0= 7.3`	No fix yet

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

NVD description

References

More vulnerabilities in com.fasterxml.jackson.core:jackson-databind

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free