CVE-2019-14379

CRITICAL9.8

Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

Apple / Xcode13.3
Debian / debian_linux8.0 – 8.0
FasterXML / jackson-databind2.0.0 – 2.6.7.3
fedoraproject / fedora30 – 30
fedoraproject / fedora29 – 29
fedoraproject / fedora31 – 31
NetApp / active_iq_unified_manager7.3 –
NetApp / active_iq_unified_manager9.5 –
NetApp / active_iq_unified_manager7.3 –
NetApp / OnCommand Workflow Automation
NetApp / service_level_manager
NetApp / SnapCenter
oracle / banking_platform2.5.0 – 2.5.0
oracle / banking_platform2.7.1 – 2.7.1
oracle / banking_platform2.7.0 – 2.7.0
oracle / banking_platform2.6.1 – 2.6.1
oracle / banking_platform2.4.0 – 2.4.0
oracle / banking_platform2.4.1 – 2.4.1
oracle / banking_platform2.6.0 – 2.6.0
oracle / communications_diameter_signaling_router8.1 – 8.1
oracle / communications_diameter_signaling_router8.0.0 – 8.0.0
oracle / communications_diameter_signaling_router8.2 – 8.2
oracle / communications_diameter_signaling_router8.2.1 – 8.2.1
oracle / communications_instant_messaging_server10.0.1.3.0 – 10.0.1.3.0
oracle / financial_services_analytical_applications_infrastructure8.0.2 – 8.0.8
oracle / goldengate_stream_analytics19.1.0.0.1
oracle / jd_edwards_enterpriseone_orchestrator9.2 – 9.2
oracle / jd_edwards_enterpriseone_tools9.2 – 9.2
oracle / primavera_gateway18.8.0 – 18.8.0
oracle / primavera_gateway17.12 – 17.12
oracle / primavera_gateway16.2 – 16.2
oracle / primavera_gateway15.2 – 15.2
oracle / primavera_unifier17.7 – 17.12
oracle / primavera_unifier16.2 – 16.2
oracle / primavera_unifier18.8 – 18.8
oracle / primavera_unifier16.1 – 16.1
oracle / retail_customer_management_and_segmentation_foundation17.0 – 17.0
oracle / retail_xstore_point_of_service7.1 – 7.1
oracle / retail_xstore_point_of_service18.0 – 18.0
oracle / retail_xstore_point_of_service17.0 – 17.0
oracle / retail_xstore_point_of_service16.0 – 16.0
oracle / retail_xstore_point_of_service15.0 – 15.0
oracle / siebel_engineering_-_installer_&_deployment19.8
oracle / Siebel UI Framework19.10
RedHat / jboss_enterprise_application_platform7.2 – 7.2
RedHat / jboss_enterprise_application_platform7.3 – 7.3
RedHat / openshift_container_platform3.11 – 3.11
RedHat / openshift_container_platform4.1 – 4.1
RedHat / single_sign-on7.3 – 7.3

References

Updated 22m ago · 8 sources