Vulnetix
Try Vulnetix Request Demo
CVE-2019-14892 PUBLISHED

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

EPSS 0.87% · 75.1th percentile

Risk Scores

EPSS Score
0.87%
75.1th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSjackson-databind2.9.4-1, 2.9.5-1, 2.9.8-1~18.04
Ubuntu:Pro:14.04:LTSjackson-databind0, 2.2.2-1, 2.2.2-1ubuntu0.1~esm1
AWSconfig

Timeline

References

Open in Interactive Console →