{"id":"CVE-2019-17267","title":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10","summary":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"fasterxml","product":"jackson-databind","affected":["jackson-databind >= 2.0.0, < 2.8.11.5","jackson-databind >= 2.9.0, < 2.9.10","active_iq_unified_manager >= 7.3","active_iq_unified_manager >= 9.5","oncommand_api_services","oncommand_workflow_automation","service_level_manager","steelstore_cloud_integrated_storage","debian_linux = 8.0","jboss_enterprise_application_platform = 7.2","jboss_enterprise_application_platform = 7.3","customer_management_and_segmentation_foundation < 18.0","goldengate_application_adapters = 19.1.0.0.0","retail_customer_management_and_segmentation_foundation = 17.0","weblogic_server = 12.2.1.3.0"],"patched":["jackson-databind 2.9.10","customer_management_and_segmentation_foundation 18.0"],"published":"2019-10-07","updated":"2026-10-07","sourceUpdated":"2026-10-07T19:17:13.227","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-17267","references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3200","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0159","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0160","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0161","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0164","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2020:0445","label":"cve@mitre.org"},{"url":"https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10","label":"cve@mitre.org"},{"url":"https://github.com/FasterXML/jackson-databind/issues/2460","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8%40%3Cdev.skywalking.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20191017-0006/","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3200","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0159","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0160","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0161","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0164","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2020:0445","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/issues/2460","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8%40%3Cdev.skywalking.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20191017-0006/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-07T18:25:08.725826Z"},"epss":0.04628,"epssPercentile":0.91447,"ingestedAt":"2026-10-07T19:44:15.636Z","slug":"CVE-2019-17267","body":"## Overview\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.\n\n## Affected\n\n- `jackson-databind >= 2.0.0, < 2.8.11.5`\n- `jackson-databind >= 2.9.0, < 2.9.10`\n- `active_iq_unified_manager >= 7.3`\n- `active_iq_unified_manager >= 9.5`\n- `oncommand_api_services`\n- `oncommand_workflow_automation`\n- `service_level_manager`\n- `steelstore_cloud_integrated_storage`\n- `debian_linux = 8.0`\n- `jboss_enterprise_application_platform = 7.2`\n- `jboss_enterprise_application_platform = 7.3`\n- `customer_management_and_segmentation_foundation < 18.0`\n- `goldengate_application_adapters = 19.1.0.0.0`\n- `retail_customer_management_and_segmentation_foundation = 17.0`\n- `weblogic_server = 12.2.1.3.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jackson-databind 2.9.10`\n- `customer_management_and_segmentation_foundation 18.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":53.9,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}