CVE-2019-14540Critical· 9.8▾ AbyssalPoC availableA Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 2.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
11%
1 GitHub repo (last check)
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
jackson-databind >= 2.0.0, < 2.6.7.3jackson-databind >= 2.7.0, < 2.8.11.5jackson-databind >= 2.9.0, < 2.9.10oncommand_api_servicesoncommand_workflow_automationsteelstore_cloud_integrated_storagefedora = 30fedora = 31debian_linux = 8.0debian_linux = 9.0debian_linux = 10.0jboss_enterprise_application_platform = 7.2jboss_enterprise_application_platform = 7.3banking_platform = 2.4.0banking_platform = 2.4.1banking_platform = 2.5.0banking_platform = 2.6.0banking_platform = 2.6.1banking_platform = 2.7.0banking_platform = 2.7.1customer_management_and_segmentation_foundation = 18.0financial_services_analytical_applications_infrastructure >= 8.0.2, <= 8.0.8global_lifecycle_management_opatch < 11.2.0.3.23global_lifecycle_management_opatch >= 12.2.0.1.0, < 12.2.0.1.19global_lifecycle_management_opatch >= 13.9.4.0.0, < 13.9.4.2.1goldengate_application_adapters = 19.1.0.0.0goldengate_stream_analytics < 19.1.0.0.1mysql >= 5.7.0, <= 5.7.30mysql >= 8.0.0, <= 8.0.20primavera_gateway = 15.2primavera_gateway = 15.2.18primavera_gateway = 16.2primavera_gateway = 16.2.11primavera_gateway = 17.12primavera_gateway = 17.12.6primavera_gateway = 18.8.0primavera_gateway = 18.8.8.1primavera_unifier >= 17.7, <= 17.12primavera_unifier = 16.1primavera_unifier = 16.2primavera_unifier = 18.8primavera_unifier = 19.12retail_customer_management_and_segmentation_foundation = 17.0retail_xstore_point_of_service = 7.1retail_xstore_point_of_service = 15.0retail_xstore_point_of_service = 16.0retail_xstore_point_of_service = 17.0retail_xstore_point_of_service = 18.0weblogic_server = 12.2.1.3.0Upgrade past the affected range:
jackson-databind 2.9.10global_lifecycle_management_opatch 13.9.4.2.1goldengate_stream_analytics 19.1.0.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2020-11113High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2019-14893Critical· 9.8A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic ty…
CVE-2019-14892Critical· 9.8A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes
CVE-2019-20330Critical· 9.8FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2020-11112High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVE-2020-11111High· 8.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).