CVE-2019-16942: Polymorphic Typing in FasterXML jackson-databind

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-01 · updated 2026-10-08
Weakness: CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Affected products

Debian Linux: 8.0, 9.0, 10.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.8.0 before 2.8.11.5; from 2.9.0 before 2.9.10.1 — fixed in 2.6.7.3, 2.8.11.5, 2.9.10.1
Fedoraproject Fedora: 30, 31
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp Oncommand Api Services: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp Service Level Manager: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2 (+3)
Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
Oracle Communications Calendar Server: 8.0.0.2.0, 8.0.0.3.0
Oracle Communications Cloud Native Core Network Slice Selection Function: 1.2.1
Oracle Communications Evolved Communications Application Server: 7.1
Oracle Database: 12.2.0.1, 18c, 19c
Oracle Corporation Global Lifecycle Management NextGen OUI Framework: 12.2.1.3.0, 12.2.1.4.0, 13.9.4.2.2
Oracle Goldengate Application Adapters: 19.1.0.0.0
Oracle Corporation JD Edwards EnterpriseOne Orchestrator: 9.2
Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.6; from 18.8.0 through 18.8.8; 19.12.0
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
Oracle Corporation Retail Merchandising System: 15.0.3, 16.0.2, 16.0.3
Oracle Retail Sales Audit: 14.1
Oracle Siebel Engineering - Installer & Deployment: through 2.20.5
Oracle Corporation Siebel UI Framework: through 20.5; 20.6
Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0
Red Hat JBoss EAP: 7.2.0, 7.3
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10.1; from 2.7.0 before 2.8.11.5; from 2.0.0 before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+110) — fixed in 2.9.10.1, 2.8.11.5, 2.6.7.3

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.8.11.5, 2.9.10.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.1, 2.8.11.5, 2.6.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-16942 or the next vulnerability affects your stack