What’s Vulnerable › Vulnerabilities
CVE-2019-14439: Deserialization of untrusted data in FasterXML jackson-databind
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 10.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-07-30 · updated 2026-10-08
- Weakness: CWE-502
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Affected products
- Apache Software Foundation Apache Drill: 1.16.0
- Debian Linux: 8.0, 9.0, 10.0
- FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.6; from 2.8.0 before 2.8.11.4; from 2.9.0 before 2.9.9.2 — fixed in 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2
- Fedoraproject Fedora: 29, 30
- Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0 (+1)
- Oracle Corporation Communications Diameter Signaling Router (DSR): 8.0.0, 8.1, 8.2, 8.2.1
- Oracle Communications Instant Messaging Server: 10.0.1.3.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.2 through 8.0.8
- Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23; from 12.2.0.1.0 before 12.2.0.1.19; from 13.9.4.0.0 before 13.9.4.2.1; 11.2.0.3.23, 13.9.4.2.1 — fixed in 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1
- Oracle Corporation GoldenGate Stream Analytics: before 19.1.0.0.1 — fixed in 19.1.0.0.1
- Oracle Corporation JD Edwards EnterpriseOne Orchestrator: 9.2
- Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
- Oracle Corporation Primavera Gateway: from 17.7 through 17.12; 15.2, 16.1, 16.2, 18.8.0
- Oracle Corporation Retail Customer Management and Segmentation Foundation: 17.0
- Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0, 18.0
- Oracle Siebel Engineering - Installer & Deployment: through 19.8
- Oracle Corporation Siebel UI Framework: through 19.10
- RedHat Jboss Middleware Text-Only Advisories: 1.0
- Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.9.2; from 2.8.0 before 2.8.11.4; from 2.7.0 before 2.7.9.6; before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+105) — fixed in 2.9.9.2, 2.8.11.4, 2.7.9.6, 2.6.7.3
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9.2; Oracle Global Lifecycle Management Opatch 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1; Oracle Corporation GoldenGate Stream Analytics 19.1.0.0.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.9.2, 2.8.11.4, 2.7.9.6, 2.6.7.3. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2019:3200
- https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b
- https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2
- https://github.com/FasterXML/jackson-databind/issues/2389
- https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E
Get alerted when CVE-2019-14439 or the next vulnerability affects your stack