VDB
CVE-2019-14893
CVE-2019-14893
PUBLISHED
CVSS 9.800000190734863 CRITICAL
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
EPSS 4.09% · 90.7th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
4.09%
90.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:14.04:LTS | jackson-databind | 2.2.2-1, 2.2.2-1ubuntu0.1~esm1, 0 |
| Ubuntu:18.04:LTS | jackson-databind | 0, 2.8.6-1, 2.9.1-1 |
Timeline
- Mar 2, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://www.cve.org/CVERecord?id=CVE-2019-14893 third-party-advisory
- Multiples vulnérabilités dans les produits IBM advisory
- https://ubuntu.com/security/CVE-2019-14893 advisory
- https://github.com/FasterXML/jackson-databind/issues/2469 discussion
- https://github.com/FasterXML/jackson-databind/commit/998efd708284778f29d83d7962a9bd935c228317 fix