CVE-2019-14439

Fixed in a distro release EPSS 11%

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Published 2019-07-30 · CVE record · OSV

Products: FasterXML jackson-databind, debian_linux, fedoraproject fedora, apache drill, redhat jboss_middleware_text-only_advisories, oracle banking_platform, oracle communications_diameter_signaling_router, oracle communications_instant_messaging_server, oracle financial_services_analytical_applications_infrastructure, oracle global_lifecycle_management_opatch, oracle goldengate_stream_analytics, oracle jd_edwards_enterpriseone_orchestrator, oracle jd_edwards_enterpriseone_tools, oracle primavera_gateway, oracle retail_customer_management_and_segmentation_foundation, oracle retail_xstore_point_of_service, oracle siebel_engineering_-_installer_&_deployment, oracle siebel_ui_framework

Fixed upstream

Distro releases