PT-2019-5806 · Jackson+2 · Jackson-Databind+2

Published 2019-09-19 · Updated 2025-01-28 · CVE-2019-14892

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.9.10 jackson-databind versions prior to 2.8.11.5 jackson-databind versions prior to 2.6.7.3

Description The issue is related to the restoration of untrusted data in memory, which can allow a remote attacker to execute arbitrary code. This is due to a flaw in jackson-databind that permits polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes.

Recommendations For versions prior to 2.9.10, update to version 2.9.10 or later. For versions prior to 2.8.11.5, update to version 2.8.11.5 or later. For versions prior to 2.6.7.3, update to version 2.6.7.3 or later. As a temporary workaround, consider restricting the use of commons-configuration 1 and 2 JNDI classes to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Information Disclosure

Weakness Enumeration

CWE-502

CWE-200

Related Identifiers

ALT-PU-2021-1792

BDU:2021-02953

CVE-2019-14892

GHSA-CF6R-3WGC-H863

RHSA-2020:0159

RHSA-2020:0160

RHSA-2020:0161

ROSA-SA-2025-2629

Affected Products

Alt Linux

Commons-Configuration

Jackson-Databind

References · 24

• https://access.redhat.com/errata/RHSA-2020:0729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14892 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14892 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02953 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-14892 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14892 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14892 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892 · Patch
• https://osv.dev/vulnerability/GHSA-cf6r-3wgc-h863 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14892 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14892 · Vendor Advisory
• https://github.com/FasterXML/jackson-databind/issues/2462 · Note
• https://github.com/FasterXML/jackson-databind/commit/819cdbcab51c6da9fb896380f2d46e9b7d4fdc3b · Note
• https://github.com/FasterXML/jackson-databind/commit/41b7f9b90149e9d44a65a8261a8deedc7186f6af · Note
• https://github.com/FasterXML/jackson-databind · Note