{"id":"CVE-2019-14439","aliases":["DEBIAN-CVE-2019-14439","DLA-1879-1","DSA-4542-1","EUVD-2019-0634","GHSA-gwp4-hfv6-p7hw","MGASA-2021-0153","ROOT-APP-MAVEN-CVE-2019-14439","UBUNTU-CVE-2019-14439","USN-4813-1","openSUSE-SU-2024:10868-1"],"status":"published","title":"Deserialization of untrusted data in FasterXML jackson-databind","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.1085,"percentile":0.95887,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2019-07-30T10:49:43Z","modified":"2026-10-24T14:03:37Z","exploits":[{"source":"pocgithub","id":"jas502n/CVE-2019-14439","title":"jas502n/CVE-2019-14439","date":"2019-08-01","url":"https://github.com/jas502n/CVE-2019-14439"}],"fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.9.9.2","2.7.9.6","2.6.7.3","2.8.11.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jackson-databind","fixed_in":["2.9.9.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jackson-databind","fixed_in":["2.9.9.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jackson-databind","fixed_in":["2.9.9.3-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.3.1-aikido.4","2.3.1-aikido.5","2.3.1-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.3.1-root.io.4","2.3.1-root.io.5","2.3.1-root.io.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","fixed_in":["2.4.2-3ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.9.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.9.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.11.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.9.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-2+deb8u8"}]}],"versions":["2.4.2-2","2.4.2-2+deb8u1","2.4.2-2+deb8u2","2.4.2-2+deb8u3","2.4.2-2+deb8u4","2.4.2-2+deb8u5","2.4.2-2+deb8u6","2.4.2-2+deb8u7"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.6-1+deb9u6"}]}],"versions":["2.8.6-1","2.8.6-1+deb9u1","2.8.6-1+deb9u2","2.8.6-1+deb9u3","2.8.6-1+deb9u4","2.8.6-1+deb9u5"],"bundled":6},{"source":"osv","ecosystem":"Debian:10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-3+deb10u1"}]}],"versions":["2.9.8-3"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.9.2"}]}],"versions":["2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.11.4"}]}],"versions":["2.8.0","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.9.6"}]}],"versions":["2.7.0","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.7.3"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2"]},{"source":"osv","ecosystem":"Mageia:7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-1.2.mga7"}]}],"bundled":32},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-aikido.4"},{"fixed":"2.3.1-aikido.5"},{"fixed":"2.3.1-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-root.io.4"},{"fixed":"2.3.1-root.io.5"},{"fixed":"2.3.1-root.io.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3ubuntu0.1~esm2"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3ubuntu0.1~esm2"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1"],"bundled":39}],"products":[{"vendor":"apache","product":"drill"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fasterxml","product":"jackson-databind"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"banking_platform"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_instant_messaging_server"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"global_lifecycle_management_opatch"},{"vendor":"oracle","product":"goldengate_stream_analytics"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_orchestrator"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"siebel_engineering_-_installer_\\\u0026_deployment"},{"vendor":"oracle","product":"siebel_ui_framework"},{"vendor":"redhat","product":"jboss_middleware_text-only_advisories"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4542","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Oct/6","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3200","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","tags":["x_refsource_MISC","x_transferred","Patch","Product","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190814-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/2389","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14439","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/"},{"url":"https://github.com/advisories/GHSA-gwp4-hfv6-p7hw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14439","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190814-0001","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0153.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25266","tags":["report"]},{"url":"https://www.debian.org/security/2019/dsa-4452","tags":["web"]},{"url":"https://www.debian.org/lts/security/2019/dla-2030","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4JYW4U272JPM7AYVNENNTWYYYAAQ4TZO/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2111","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2135","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2153","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2179","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1523","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2406","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4366","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-January/008253.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6X2UT4X6M7DLQYBOOHMXBWGYJ65RL2CT/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14439","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4813-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-16335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-16942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-16943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-20330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-9546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-9547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-9548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14195","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-07-30T10:49:43Z","modified":"2026-10-08T21:03:20.659Z","updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-0634","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-07-30T10:49:43Z","modified":"2026-10-08T21:03:20Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-gwp4-hfv6-p7hw","title":"Deserialization of untrusted data in FasterXML jackson-databind","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-08-01T19:18:06Z","modified":"2023-11-27T23:03:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:22.840002Z"}],"nvd":[{"id":"CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-07-30T11:15:11.123Z","modified":"2026-10-08T21:17:13.27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-07-30T11:15:11.123Z","modified":"2026-10-24T14:03:37.001918922Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-07-30T11:15:11.123Z","modified":"2026-10-09T09:47:33.190720702Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-gwp4-hfv6-p7hw","title":"Deserialization of untrusted data in FasterXML jackson-databind","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-08-01T19:18:06Z","modified":"2024-03-13T05:27:58.436849Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"UBUNTU-CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.","status":"published","published":"2019-07-30T11:15:00Z","modified":"2026-02-04T03:59:23.703288Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1879-1","title":"jackson-databind - security update","status":"published","published":"2019-08-12T00:00:00Z","modified":"2026-03-09T01:18:55.510916Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4542-1","title":"jackson-databind - security update","status":"published","published":"2019-10-06T00:00:00Z","modified":"2026-03-09T02:08:39.515187Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2021-0153","title":"Updated jackson-databind packages fix security vulnerabilities","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x\nbefore 2.9.9. When Default Typing is enabled (either globally or for a specific\nproperty) for an externally exposed JSON endpoint, the service has the\nmysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker\ncan host a crafted MySQL server reachable by the victim, an attacker can send\na crafted JSON message that allows them to read arbitrary local files on the\nserver. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin\nvalidation (CVE-2019-12086).\n\nFasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a\nvariety of impacts by leveraging failure to block the logback-core class from\npolymorphic deserialization. Depending on the classpath content, remote code\nexecution may be possible (CVE-2019-12384).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x\nthrough 2.9.9. When Default Typing is enabled (either globally or for a specific\nproperty) for an externally exposed JSON endpoint and the service has JDOM\n1.x or 2.x jar in the classpath, an attacker can send a specifically crafted\nJSON message that allows them to read arbitrary local files on the server\n(CVE-2019-12814).\n\nSubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles\ndefault typing when ehcache is used (because of\nnet.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup),\nleading to remote code execution (CVE-2019-14379).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x\nbefore 2.9.9.2. This occurs when Default Typing is enabled (either globally or\nfor a specific property) for an externally exposed JSON endpoint and the\nservice has the logback jar in the classpath (CVE-2019-14439).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind before\n2.9.10. It is related to com.zaxxer.hikari.HikariConfig (CVE-2019-14540).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind before\n2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different\nvulnerability than CVE-2019-14540 (CVE-2019-16335).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0\nthrough 2.9.10. When Default Typing is enabled (either globally or for a\nspecific property) for an externally exposed JSON endpoint and the service has\nthe commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI\nservice endpoint to access, it is possible to make the service execute a\nmalicious payload. This issue exists because of\norg.apache.commons.dbcp.datasources.SharedPoolDataSource and\norg.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling\n(CVE-2019-16942).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0\nthrough 2.9.10. When Default Typing is enabled (either globally or for a\nspecific property) for an externally exposed JSON endpoint and the service has\nthe p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI\nservice endpoint to access, it is possible to make the service execute a\nmalicious payload. This issue exists because of\ncom.p6spy.engine.spy.P6DataSource mishandling (CVE-2019-16943).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind before\n2.9.10. It is related to\nnet.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup (CVE-2019-17267).\n\nA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0\nthrough 2.9.10. When Default Typing is enabled (either globally or for a\nspecific property) for an externally exposed JSON endpoint and the service has \nthe apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker\ncan provide a JNDI service to access, it is possible to make the service\nexecute a malicious payload (CVE-2019-17531).\n\nFasterXML jackson-databind 2.x before 2.9.10.2 lacks certain\nnet.sf.ehcache blocking (CVE-2019-20330).\n\nFasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI\nblocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter\n(CVE-2020-8840).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)\n(CVE-2020-9546).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\ncom.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)\n(CVE-2020-9547).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\nbr.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core) (CVE-2020-9548).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.apache.aries.transaction.jms.internal.XaPooledConnectionFactory\n(aka aries.transaction.jms) (CVE-2020-10672).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\ncom.caucho.config.types.ResourceRef (aka caucho-quercus) (CVE-2020-10673).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy)\n(CVE-2020-10968).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to javax.swing.JEditorPane\n(CVE-2020-10969).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to org.apache.activemq.*\n(aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms)\n(CVE-2020-11111). \n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.apache.commons.proxy.provider.remoting.RmiProvider\n(aka apache/commons-proxy) (CVE-2020-11112).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa) (CVE-2020-11113).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop)\n(CVE-2020-11619).\n\nFasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.apache.commons.jelly.impl.Embedded (aka commons-jelly) (CVE-2020-11620).\n\nFasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between\nserialization gadgets and typing, related to\noadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill)\n(CVE-2020-14060).\n\nFasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction\nbetween serialization gadgets and typing, related to\noracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory,\noracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory,\nand oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).\n(CVE-2020-14061).\n\nFasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction\nbetween serialization gadgets and typing, related to\ncom.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2)\n(CVE-2020-14062).\n\nFasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction\nbetween serialization gadgets and typing, related to\norg.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity) (CVE-2020-14195).\n\nA flaw was found in FasterXML Jackson Databind, where it did not have entity\nexpansion secured properly. This flaw allows vulnerability to XML external\nentity (XXE) attacks. The highest threat from this vulnerability is data\nintegrity (CVE-2020-25649).\n\nFasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction\nbetween serialization gadgets and typing, related to\ncom.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded\nXalan in org.glassfish.web/javax.servlet.jsp.jstl) (CVE-2020-35728).\n\nA flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles\nthe interaction between serialization gadgets and typing. The highest threat\nfrom this vulnerability is to data confidentiality and integrity as well as\nsystem availability (CVE-2021-20190).\n","status":"published","published":"2021-03-27T14:27:02Z","modified":"2026-04-16T04:44:25.952391772Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:10868-1","title":"jackson-databind-2.10.5.1-2.2 on GA media","description":"These are all security issues fixed in the jackson-databind-2.10.5.1-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:58.422529Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"ROOT-APP-MAVEN-CVE-2019-14439","title":"CVE-2019-14439 in com.fasterxml.jackson.core:jackson-databind - Patched by Root","description":"Root has patched CVE-2019-14439 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-24T12:30:14Z","modified":"2026-08-24T14:30:19.109462208Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"USN-4813-1","title":"jackson-databind vulnerabilities","description":"It was discovered that Jackson Databind incorrectly handled\ndeserialization. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)\n\nIt was discovered that Jackson Databind incorrectly handled\ndeserialization. An attacker could possibly use this issue to execute\narbitrary code or other unspecified impact. (CVE-2018-12022,\nCVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360,\nCVE-2018-19361, CVE-2018-19362, CVE-2019-12384, CVE-2019-14379,\nCVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942,\nCVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330,\nCVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969,\nCVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619,\nCVE-2020-11620, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062,\nCVE-2020-14195, CVE-2020-8840, CVE-2020-9546, CVE-2020-9547, CVE-2020-9548)\n\nIt was discovered that Jackson Databind incorrectly handled\ndeserialization. An attacker could possibly use this issue to execute XML\nentity (XXE) attacks. (CVE-2018-14720)\n\nIt was discovered that Jackson Databind incorrectly handled\ndeserialization. An attacker could possibly use this issue to execute\nserver-side request forgery (SSRF). (CVE-2018-14721)\n","status":"published","published":"2021-03-15T21:47:52Z","modified":"2026-10-12T14:20:21.353062163Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}