CVE-2019-14379 PUBLISHED

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

EPSS 1.46% · 80.7th percentile

Risk Scores

EPSS Score
1.46%
80.7th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSjackson-databind2.9.4-1, 0, 2.8.6-1
Ubuntu:Pro:16.04:LTSjackson-databind2.4.2-3ubuntu0.1~esm1, 0, 2.4.2-2
Ubuntu:Pro:14.04:LTSjackson-databind0, 2.2.2-1ubuntu0.1~esm1, 2.2.2-1

Timeline

References

Open in Interactive Console →