CVE-2019-14439
HIGH
7.5
CVSS Score
Published: July 30, 2019 at 10:49 AM UTC
Updated: October 8, 2026 at 09:17 PM UTC
18 products affected across 6 vendorsDebian LinuxFedoraJD Edwards EnterpriseOne Tools
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 11%
SSVC
No known exploit
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Debian Linux· Debiandrupal
95%95%
2.0.0 ≤ v < 2.6.7.32.7.0 ≤ v < 2.7.9.62.8.0 ≤ v < 2.8.11.42.9.0 ≤ v < 2.9.9.2*
Affected range stops below 2.6.7.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.7.9.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.8.11.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.9.9.2, so it looks safe — our inference, not a vendor statement
8.0.2 ≤ v ≤ 8.0.8*
Affected range stops below 11.2.0.3.23, so it looks safe — our inference, not a vendor statement
Affected range stops below 12.2.0.1.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 13.9.4.2.1, so it looks safe — our inference, not a vendor statement
v < 19.1.0.0.1*
Affected range stops below 19.1.0.0.1, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://access.redhat.com/errata/RHSA-2019:3200
- https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b
- https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/
References (29)
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:3200x_refsource_MISCPatch
Source: [email protected]
https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125bx_refsource_MISCPatchProduct
Source: [email protected]
https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2x_refsource_MISCIssue TrackingThird Party Advisory
Source: [email protected]
https://github.com/FasterXML/jackson-databind/issues/2389Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3ESSVC — Action Prioritization
SSVCNo known exploitAutomatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-502
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card