critical
9.8
CWE
915 1321 502
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2019-14379

First published: Tue Jul 23 2019(Updated: )

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Credit: CVE-2019-14379 CVE-2021-44228 cve@mitre.org cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
maven/com.fasterxml.jackson.core:jackson-databind<2.7.9.6
2.7.9.6
maven/com.fasterxml.jackson.core:jackson-databind>=2.8.0<2.8.11.4
2.8.11.4
maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<2.9.9.2
2.9.9.2
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el6ea
0:2.9.0-1.redhat_00005.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el6ea
0:1.9.13-9.redhat_00006.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el6ea
0:2.3.5-4.SP3_redhat_00002.1.el6ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el6ea
0:3.0.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el6ea
0:5.3.11-2.SP1_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el6ea
0:9.3.7-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.17-1.Final_redhat_00001.1.el6ea
0:1.4.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jackson-core<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jackson-databind<0:2.9.9.3-1.redhat_00001.1.el6ea
0:2.9.9.3-1.redhat_00001.1.el6ea
redhat/eap7-jackson-jaxrs-providers<0:2.9.9-2.redhat_00001.1.el6ea
0:2.9.9-2.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-base<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-java8<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.23-1.Final_redhat_00001.1.el6ea
0:4.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-logging<0:3.3.3-1.Final_redhat_00001.1.el6ea
0:3.3.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-logmanager<0:2.1.14-1.Final_redhat_00001.1.el6ea
0:2.1.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-marshalling<0:2.0.9-1.Final_redhat_00001.1.el6ea
0:2.0.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-msc<0:1.4.8-1.Final_redhat_00001.1.el6ea
0:1.4.8-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.14-1.SP1_redhat_00001.1.el6ea
0:5.0.14-1.SP1_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.3.1-4.Final_redhat_00004.1.el6ea
0:1.3.1-4.Final_redhat_00004.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.3-1.Final_redhat_00001.1.el6ea
0:3.7.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jgroups<0:4.0.20-1.Final_redhat_00001.1.el6ea
0:4.0.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-narayana<0:5.9.6-1.Final_redhat_00001.1.el6ea
0:5.9.6-1.Final_redhat_00001.1.el6ea
redhat/eap7-netty<0:4.1.34-2.Final_redhat_00002.1.el6ea
0:4.1.34-2.Final_redhat_00002.1.el6ea
redhat/eap7-picketbox<0:5.0.3-5.Final_redhat_00004.1.el6ea
0:5.0.3-5.Final_redhat_00004.1.el6ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00007.1.el6ea
0:2.5.5-20.SP12_redhat_00007.1.el6ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00007.1.el6ea
0:2.5.5-20.SP12_redhat_00007.1.el6ea
redhat/eap7-undertow<0:2.0.25-1.SP1_redhat_00001.1.el6ea
0:2.0.25-1.SP1_redhat_00001.1.el6ea
redhat/eap7-weld-core<0:3.0.6-2.Final_redhat_00002.1.el6ea
0:3.0.6-2.Final_redhat_00002.1.el6ea
redhat/eap7-wildfly<0:7.2.4-1.GA_redhat_00002.1.el6ea
0:7.2.4-1.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.6.4-1.Final_redhat_00001.1.el6ea
0:1.6.4-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-elytron-tool<0:1.4.3-1.Final_redhat_00001.1.el6ea
0:1.4.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-transaction-client<0:1.1.6-2.Final_redhat_00001.1.el6ea
0:1.1.6-2.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el7ea
0:2.9.0-1.redhat_00005.1.el7ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el7ea
0:1.9.13-9.redhat_00006.1.el7ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el7ea
0:2.3.5-4.SP3_redhat_00002.1.el7ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el7ea
0:3.0.16-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el7ea
0:5.3.11-2.SP1_redhat_00001.1.el7ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el7ea
0:9.3.7-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.17-1.Final_redhat_00001.1.el7ea
0:1.4.17-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-annotations<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jackson-core<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jackson-databind<0:2.9.9.3-1.redhat_00001.1.el7ea
0:2.9.9.3-1.redhat_00001.1.el7ea
redhat/eap7-jackson-jaxrs-providers<0:2.9.9-2.redhat_00001.1.el7ea
0:2.9.9-2.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-base<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-java8<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.23-1.Final_redhat_00001.1.el7ea
0:4.0.23-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-logging<0:3.3.3-1.Final_redhat_00001.1.el7ea
0:3.3.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-logmanager<0:2.1.14-1.Final_redhat_00001.1.el7ea
0:2.1.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-marshalling<0:2.0.9-1.Final_redhat_00001.1.el7ea
0:2.0.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-msc<0:1.4.8-1.Final_redhat_00001.1.el7ea
0:1.4.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.14-1.SP1_redhat_00001.1.el7ea
0:5.0.14-1.SP1_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.3.1-4.Final_redhat_00004.1.el7ea
0:1.3.1-4.Final_redhat_00004.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.3-1.Final_redhat_00001.1.el7ea
0:3.7.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-jgroups<0:4.0.20-1.Final_redhat_00001.1.el7ea
0:4.0.20-1.Final_redhat_00001.1.el7ea
redhat/eap7-narayana<0:5.9.6-1.Final_redhat_00001.1.el7ea
0:5.9.6-1.Final_redhat_00001.1.el7ea
redhat/eap7-netty<0:4.1.34-2.Final_redhat_00002.1.el7ea
0:4.1.34-2.Final_redhat_00002.1.el7ea
redhat/eap7-picketbox<0:5.0.3-5.Final_redhat_00004.1.el7ea
0:5.0.3-5.Final_redhat_00004.1.el7ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00007.1.el7ea
0:2.5.5-20.SP12_redhat_00007.1.el7ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00007.1.el7ea
0:2.5.5-20.SP12_redhat_00007.1.el7ea
redhat/eap7-undertow<0:2.0.25-1.SP1_redhat_00001.1.el7ea
0:2.0.25-1.SP1_redhat_00001.1.el7ea
redhat/eap7-weld-core<0:3.0.6-2.Final_redhat_00002.1.el7ea
0:3.0.6-2.Final_redhat_00002.1.el7ea
redhat/eap7-wildfly<0:7.2.4-1.GA_redhat_00002.1.el7ea
0:7.2.4-1.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.6.4-1.Final_redhat_00001.1.el7ea
0:1.6.4-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-elytron-tool<0:1.4.3-1.Final_redhat_00001.1.el7ea
0:1.4.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-transaction-client<0:1.1.6-2.Final_redhat_00001.1.el7ea
0:1.1.6-2.Final_redhat_00001.1.el7ea
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el8ea
0:2.9.0-1.redhat_00005.1.el8ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el8ea
0:1.9.13-9.redhat_00006.1.el8ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el8ea
0:2.3.5-4.SP3_redhat_00002.1.el8ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el8ea
0:3.0.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el8ea
0:5.3.11-2.SP1_redhat_00001.1.el8ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el8ea
0:9.3.7-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.17-1.Final_redhat_00001.1.el8ea
0:1.4.17-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-annotations<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jackson-core<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jackson-databind<0:2.9.9.3-1.redhat_00001.1.el8ea
0:2.9.9.3-1.redhat_00001.1.el8ea
redhat/eap7-jackson-jaxrs-providers<0:2.9.9-2.redhat_00001.1.el8ea
0:2.9.9-2.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-base<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-java8<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.23-1.Final_redhat_00001.1.el8ea
0:4.0.23-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-logging<0:3.3.3-1.Final_redhat_00001.1.el8ea
0:3.3.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-logmanager<0:2.1.14-1.Final_redhat_00001.1.el8ea
0:2.1.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-marshalling<0:2.0.9-1.Final_redhat_00001.1.el8ea
0:2.0.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-msc<0:1.4.8-1.Final_redhat_00001.1.el8ea
0:1.4.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.14-1.SP1_redhat_00001.1.el8ea
0:5.0.14-1.SP1_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.3.1-4.Final_redhat_00004.1.el8ea
0:1.3.1-4.Final_redhat_00004.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.3-1.Final_redhat_00001.1.el8ea
0:3.7.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-jgroups<0:4.0.20-1.Final_redhat_00001.1.el8ea
0:4.0.20-1.Final_redhat_00001.1.el8ea
redhat/eap7-narayana<0:5.9.6-1.Final_redhat_00001.1.el8ea
0:5.9.6-1.Final_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.34-2.Final_redhat_00002.1.el8ea
0:4.1.34-2.Final_redhat_00002.1.el8ea
redhat/eap7-picketbox<0:5.0.3-5.Final_redhat_00004.1.el8ea
0:5.0.3-5.Final_redhat_00004.1.el8ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00007.1.el8ea
0:2.5.5-20.SP12_redhat_00007.1.el8ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00007.1.el8ea
0:2.5.5-20.SP12_redhat_00007.1.el8ea
redhat/eap7-undertow<0:2.0.25-1.SP1_redhat_00001.1.el8ea
0:2.0.25-1.SP1_redhat_00001.1.el8ea
redhat/eap7-weld-core<0:3.0.6-2.Final_redhat_00002.1.el8ea
0:3.0.6-2.Final_redhat_00002.1.el8ea
redhat/eap7-wildfly<0:7.2.4-1.GA_redhat_00002.1.el8ea
0:7.2.4-1.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.6.4-1.Final_redhat_00001.1.el8ea
0:1.6.4-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-elytron-tool<0:1.4.3-1.Final_redhat_00001.1.el8ea
0:1.4.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-transaction-client<0:1.1.6-2.Final_redhat_00001.1.el8ea
0:1.1.6-2.Final_redhat_00001.1.el8ea
redhat/rh-sso7-keycloak<0:4.8.13-1.Final_redhat_00001.1.el6
0:4.8.13-1.Final_redhat_00001.1.el6
redhat/rh-sso7-keycloak<0:4.8.13-1.Final_redhat_00001.1.el7
0:4.8.13-1.Final_redhat_00001.1.el7
redhat/rh-sso7-libunix-dbus-java<0:0.8.0-2.el7
0:0.8.0-2.el7
redhat/rh-sso7-keycloak<0:4.8.13-1.Final_redhat_00001.1.el8
0:4.8.13-1.Final_redhat_00001.1.el8
redhat/rh-maven35-jackson-databind<0:2.7.6-2.7.el7
0:2.7.6-2.7.el7
debian/jackson-databind
2.9.8-3+deb10u3
2.9.8-3+deb10u5
2.12.1-1+deb11u1
2.14.0-1
IBM RQM<=6.0.6.1
IBM RQM<=6.0.6
IBM ETM<=7.0.0
IBM RQM<=6.0.2
IBM EWM<=7.0
IBM CLM<=6.0.6.1
IBM CLM<=6.0.6
IBM ELM<=7.0
IBM CLM<=6.0.2
IBM RDNG<=6.0.2
IBM RDNG<=6.0.6.1
IBM RDNG<=6.0.6
IBM DOORS Next<=7.0
redhat/jackson-databind<2.9.9.2
2.9.9.2
redhat/jackson-databind<2.10.0
2.10.0
redhat/jackson-databind<2.7.9.6
2.7.9.6
redhat/jackson-databind<2.8.11.4
2.8.11.4
Apple Xcode<13.3
13.3
FasterXML jackson-databind>=2.0.0<2.6.7.3
FasterXML jackson-databind>=2.7.0<2.7.9.6
FasterXML jackson-databind>=2.8.0<2.8.11.4
FasterXML jackson-databind>=2.9.0<2.9.9.2
Debian Debian Linux=8.0
NetApp Active IQ Unified Manager>=7.3
netapp active iq unified manager windows>=7.3
NetApp Active IQ Unified Manager for VMware vSphere>=9.5
NetApp OnCommand Workflow Automation
NetApp Service Level Manager
netapp snapcenter
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Fedoraproject Fedora=31
redhat jboss enterprise application platform=7.2
redhat jboss enterprise application platform=7.3
redhat openshift container platform=4.1
redhat single sign-on=7.3
Red Hat Enterprise Linux=7.0
redhat openshift container platform=3.11
Red Hat Enterprise Linux=6.0
Red Hat Enterprise Linux=8.0
oracle banking platform=2.4.0
oracle banking platform=2.4.1
oracle banking platform=2.5.0
oracle banking platform=2.6.0
oracle banking platform=2.6.1
oracle banking platform=2.7.0
oracle banking platform=2.7.1
Oracle Communications Diameter Signaling Router=8.0.0
Oracle Communications Diameter Signaling Router=8.1
Oracle Communications Diameter Signaling Router=8.2
Oracle Communications Diameter Signaling Router=8.2.1
oracle communications instant messaging server=10.0.1.3.0
Oracle Financial Services Analytical Applications Infrastructure>=8.0.2<=8.0.8
Oracle GoldenGate Stream Analytics<19.1.0.0.1
Oracle JD Edwards EnterpriseOne Orchestrator=9.2
Oracle JD Edwards EnterpriseOne Tools=9.2
oracle primavera gateway=15.2
oracle primavera gateway=16.2
oracle primavera gateway=17.12
oracle primavera gateway=18.8.0
Oracle Primavera Unifier>=17.7<=17.12
Oracle Primavera Unifier=16.1
Oracle Primavera Unifier=16.2
Oracle Primavera Unifier=18.8
Oracle Retail Customer Management and Segmentation Foundation=17.0
Oracle Retail Xstore Office Cloud Service=7.1
Oracle Retail Xstore Office Cloud Service=15.0
Oracle Retail Xstore Office Cloud Service=16.0
Oracle Retail Xstore Office Cloud Service=17.0
Oracle Retail Xstore Office Cloud Service=18.0
Oracle Siebel Engineering - Installer & Deployment<=19.8
Oracle Siebel User Interface Framework<=19.10
Apple Xcode<13.3
NetApp SnapCenter
Oracle Communications Instant Messaging Server=10.0.1.3.0
Oracle Customer Management and Segmentation Foundation=17.0

Remedy

https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2

Remedy

https://github.com/FasterXML/jackson-databind/issues/2387

Remedy

https://www.oracle.com/security-alerts/cpuApr2021.html

Remedy

https://www.oracle.com/security-alerts/cpuoct2020.html

Remedy

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Remedy

The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is the severity of CVE-2019-14379?

    CVE-2019-14379 is classified as a high severity vulnerability due to its potential for remote code execution.

  • How do I fix CVE-2019-14379?

    To remediate CVE-2019-14379, upgrade to jackson-databind version 2.9.9.2 or later.

  • What causes CVE-2019-14379?

    CVE-2019-14379 is caused by improper handling of polymorphic types during deserialization in jackson-databind.

  • Which software is affected by CVE-2019-14379?

    CVE-2019-14379 affects multiple versions of FasterXML jackson-databind and related software that enables polymorphic type handling.

  • Can CVE-2019-14379 be exploited remotely?

    Yes, CVE-2019-14379 can be exploited remotely if the vulnerable application allows untrusted data to be deserialized.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203