What’s Vulnerable › Vulnerabilities
CVE-2019-17531: jackson-databind polymorphic typing issue
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-10-12 · updated 2026-10-08
- Weakness: CWE-502
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Affected products
- Debian Linux: 8.0
- FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.8.11.5; from 2.9.0 before 2.9.10.1 — fixed in 2.6.7.3, 2.8.11.5, 2.9.10.1
- NetApp OnCommand Workflow Automation: all versions
- NetApp Steelstore Cloud Integrated Storage: all versions
- Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2 (+3)
- Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Calendar Server: 8.0.0.2.0, 8.0.0.3.0
- Oracle Communications Cloud Native Core Network Slice Selection Function: 1.2.1
- Oracle Communications Evolved Communications Application Server: 7.1
- Oracle Corporation Global Lifecycle Management NextGen OUI Framework: 12.2.1.3.0, 12.2.1.4.0, 13.9.4.2.2
- Oracle Goldengate Application Adapters: 19.1.0.0.0
- Oracle Corporation JD Edwards EnterpriseOne Orchestrator: 9.2
- Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
- Oracle Corporation Primavera Gateway: from 17.7 through 17.12.6; from 18.8.0 through 18.8.8; 16.1, 16.2, 19.12.0
- Oracle Corporation Retail Merchandising System: 15.0.3, 16.0.2, 16.0.3
- Oracle Retail Sales Audit: 14.1
- Oracle Siebel Engineering - Installer & Deployment: through 2.20.5
- Oracle Trace File Analyzer: 12.2.0.1, 18c, 19c
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
- Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0
- Red Hat JBoss EAP: 7.2, 7.3
- Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10.1; from 2.7.0 before 2.8.11.5; before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+113) — fixed in 2.9.10.1, 2.8.11.5, 2.6.7.3
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.8.11.5, 2.9.10.1; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.1, 2.8.11.5, 2.6.7.3. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2019:4192
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/errata/RHSA-2020:0161
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0445
- https://github.com/FasterXML/jackson-databind/issues/2498
- https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html
Get alerted when CVE-2019-17531 or the next vulnerability affects your stack