GHSA-6fpp-rgj9-8rwcCriticalCVSS 9.8

Deserialization of untrusted data in FasterXML jackson-databind

Published
August 1, 2019
Last Modified
September 13, 2023

🔗 CVE IDs covered (1)

CVE-2019-14379 →

📋 Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

🎯 Affected products3

  • maven/com.fasterxml.jackson.core:jackson-databind:>= 2.9.0, < 2.9.9.2
  • maven/com.fasterxml.jackson.core:jackson-databind:>= 2.8.0, < 2.8.11.4
  • maven/com.fasterxml.jackson.core:jackson-databind:< 2.7.9.6

🔗 References (62)