CVE-2019-14379: Deserialization of untrusted data in FasterXML jackson-databind

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-29 · updated 2026-10-08
Weakness: CWE-1321

Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Affected products

Apple Xcode: before 13.3 — fixed in 13.3
Debian Linux: 8.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.6; from 2.8.0 before 2.8.11.4; from 2.9.0 before 2.9.9.2 — fixed in 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2
Fedoraproject Fedora: 29, 30, 31
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp OnCommand Workflow Automation: all versions
NetApp Service Level Manager: all versions
NetApp SnapCenter: all versions
Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0 (+1)
Oracle Corporation Communications Diameter Signaling Router (DSR): 8.0.0, 8.1, 8.2, 8.2.1
Oracle Communications Instant Messaging Server: 10.0.1.3.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.2 through 8.0.8
Oracle Corporation GoldenGate Stream Analytics: before 19.1.0.0.1 — fixed in 19.1.0.0.1
Oracle Corporation JD Edwards EnterpriseOne Orchestrator: 9.2
Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
Oracle Corporation Primavera Gateway: 15.2, 16.2, 17.12, 18.8.0
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8
Oracle Corporation Retail Customer Management and Segmentation Foundation: 17.0
Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0, 18.0
Oracle Siebel Engineering - Installer & Deployment: through 19.8
Oracle Corporation Siebel UI Framework: through 19.10
Red Hat JBoss EAP: 7.2, 7.3
Red Hat OpenShift Container Platform 4.18: 4.1, 3.11
Red Hat Single Sign-On: 7.3
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.9.2; from 2.8.0 before 2.8.11.4; before 2.7.9.6; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+111) — fixed in 2.9.9.2, 2.8.11.4, 2.7.9.6

How to fix

Upgrade to a fixed version: Apple Xcode 13.3; FasterXML jackson-databind 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2; Oracle Corporation GoldenGate Stream Analytics 19.1.0.0.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.9.2, 2.8.11.4, 2.7.9.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-14379 or the next vulnerability affects your stack