CVE-2019-14379
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-1321
Description
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Affected packages
| Maven | com.fasterxml.jackson.core:jackson-databind | 0 → 2.7.9.6 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.8.0 → 2.8.11.4 |
| Maven | com.fasterxml.jackson.core:jackson-databind | 2.9.0 → 2.9.9.2 |
References
- http://seclists.org/fulldisclosure/2022/Mar/23
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2743
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:2935
- https://access.redhat.com/errata/RHSA-2019:2936
- https://access.redhat.com/errata/RHSA-2019:2937
- https://access.redhat.com/errata/RHSA-2019:2938
- https://access.redhat.com/errata/RHSA-2019:2998
- https://access.redhat.com/errata/RHSA-2019:3044
- https://access.redhat.com/errata/RHSA-2019:3045
- https://access.redhat.com/errata/RHSA-2019:3046
Status: profiled · ingested 2026-10-09T00:00:43.000Z