PT-2019-2950 · Qos.Ch+7 · Logback-Core+7

Published 2019-05-16 · Updated 2025-09-29 · CVE-2019-12384

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x through 2.9.9

Description The issue is related to the failure to block the logback-core class from polymorphic deserialization, which can lead to various impacts, including remote code execution, depending on the classpath content. This can allow an attacker to have unauthorized access and execute arbitrary code.

Recommendations For FasterXML jackson-databind versions 2.x through 2.9.9, update to version 2.9.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the logback-core class to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ALSA-2019:2720

ALSA-2019_2720

ALSA-2025_16880

ALT-PU-2020-3030

BDU:2019-02925

BDU:2019-04252

CESA-2019_2720

CVE-2019-12384

DLA-1831-1

DSA-4542-1

ELSA-2019-2720

GHSA-MPH4-VHRX-MV67

MGASA-2021-0153

OPENSUSE-SU-2024:10868-1

RHSA-2019:1820

RHSA-2019:2720

RHSA-2019:2935

RHSA-2019:2936

RHSA-2019:2937

RHSA-2019_2720

RHSA-2024:5856

RLSA-2019:2720

RLSA-2019_2720

USN-4813-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Ubuntu

Jackson-Databind

Logback-Core

References · 148

• 🔥 https://github.com/jas502n/CVE-2019-12384 · Exploit
• 🔥 https://github.com/MagicZer0/Jackson_RCE-CVE-2019-12384 · Exploit
• https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad · Patch
• https://access.redhat.com/errata/RHSA-2019:4352 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2936 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6X2UT4X6M7DLQYBOOHMXBWGYJ65RL2CT · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12384 · Security Note
• https://ubuntu.com/security/CVE-2019-17267 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2019-2720.html · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2111 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2935 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2019:2720 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3901 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4813-1 · Vendor Advisory