CVE-2019-14379

Published Jul 23, 2019
·
Updated

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Credit

CVE-2019-14379, CVE-2021-44228

Affected Software

169 affected componentsFixes available
maven/com.fasterxml.jackson.core:jackson-databind<2.7.9.6
2.7.9.6
maven/com.fasterxml.jackson.core:jackson-databind>=2.8.0<2.8.11.4
2.8.11.4
maven/com.fasterxml.jackson.core:jackson-databind>=2.9.0<2.9.9.2
2.9.9.2
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el6ea
0:2.9.0-1.redhat_00005.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el6ea
0:1.9.13-9.redhat_00006.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el6ea
0:2.3.5-4.SP3_redhat_00002.1.el6ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el6ea
0:3.0.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el6ea
0:5.3.11-2.SP1_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el6ea
0:9.3.7-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.17-1.Final_redhat_00001.1.el6ea
0:1.4.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jackson-core<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jackson-databind<0:2.9.9.3-1.redhat_00001.1.el6ea
0:2.9.9.3-1.redhat_00001.1.el6ea
redhat/eap7-jackson-jaxrs-providers<0:2.9.9-2.redhat_00001.1.el6ea
0:2.9.9-2.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-base<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-java8<0:2.9.9-1.redhat_00001.1.el6ea
0:2.9.9-1.redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.23-1.Final_redhat_00001.1.el6ea
0:4.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-logging<0:3.3.3-1.Final_redhat_00001.1.el6ea
0:3.3.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-logmanager<0:2.1.14-1.Final_redhat_00001.1.el6ea
0:2.1.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-marshalling<0:2.0.9-1.Final_redhat_00001.1.el6ea
0:2.0.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-msc<0:1.4.8-1.Final_redhat_00001.1.el6ea
0:1.4.8-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.14-1.SP1_redhat_00001.1.el6ea
0:5.0.14-1.SP1_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.3.1-4.Final_redhat_00004.1.el6ea
0:1.3.1-4.Final_redhat_00004.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.3-1.Final_redhat_00001.1.el6ea
0:3.7.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jgroups<0:4.0.20-1.Final_redhat_00001.1.el6ea
0:4.0.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-narayana<0:5.9.6-1.Final_redhat_00001.1.el6ea
0:5.9.6-1.Final_redhat_00001.1.el6ea
redhat/eap7-netty<0:4.1.34-2.Final_redhat_00002.1.el6ea
0:4.1.34-2.Final_redhat_00002.1.el6ea
redhat/eap7-picketbox<0:5.0.3-5.Final_redhat_00004.1.el6ea
0:5.0.3-5.Final_redhat_00004.1.el6ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00007.1.el6ea
0:2.5.5-20.SP12_redhat_00007.1.el6ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00007.1.el6ea
0:2.5.5-20.SP12_redhat_00007.1.el6ea
redhat/eap7-undertow<0:2.0.25-1.SP1_redhat_00001.1.el6ea
0:2.0.25-1.SP1_redhat_00001.1.el6ea
redhat/eap7-weld-core<0:3.0.6-2.Final_redhat_00002.1.el6ea
0:3.0.6-2.Final_redhat_00002.1.el6ea
redhat/eap7-wildfly<0:7.2.4-1.GA_redhat_00002.1.el6ea
0:7.2.4-1.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.6.4-1.Final_redhat_00001.1.el6ea
0:1.6.4-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-elytron-tool<0:1.4.3-1.Final_redhat_00001.1.el6ea
0:1.4.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-transaction-client<0:1.1.6-2.Final_redhat_00001.1.el6ea
0:1.1.6-2.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el7ea
0:2.9.0-1.redhat_00005.1.el7ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el7ea
0:1.9.13-9.redhat_00006.1.el7ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el7ea
0:2.3.5-4.SP3_redhat_00002.1.el7ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el7ea
0:3.0.16-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el7ea
0:5.3.11-2.SP1_redhat_00001.1.el7ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el7ea
0:9.3.7-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.17-1.Final_redhat_00001.1.el7ea
0:1.4.17-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-annotations<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jackson-core<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jackson-databind<0:2.9.9.3-1.redhat_00001.1.el7ea
0:2.9.9.3-1.redhat_00001.1.el7ea
redhat/eap7-jackson-jaxrs-providers<0:2.9.9-2.redhat_00001.1.el7ea
0:2.9.9-2.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-base<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-java8<0:2.9.9-1.redhat_00001.1.el7ea
0:2.9.9-1.redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.23-1.Final_redhat_00001.1.el7ea
0:4.0.23-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-logging<0:3.3.3-1.Final_redhat_00001.1.el7ea
0:3.3.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-logmanager<0:2.1.14-1.Final_redhat_00001.1.el7ea
0:2.1.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-marshalling<0:2.0.9-1.Final_redhat_00001.1.el7ea
0:2.0.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-msc<0:1.4.8-1.Final_redhat_00001.1.el7ea
0:1.4.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.14-1.SP1_redhat_00001.1.el7ea
0:5.0.14-1.SP1_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.3.1-4.Final_redhat_00004.1.el7ea
0:1.3.1-4.Final_redhat_00004.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.3-1.Final_redhat_00001.1.el7ea
0:3.7.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-jgroups<0:4.0.20-1.Final_redhat_00001.1.el7ea
0:4.0.20-1.Final_redhat_00001.1.el7ea
redhat/eap7-narayana<0:5.9.6-1.Final_redhat_00001.1.el7ea
0:5.9.6-1.Final_redhat_00001.1.el7ea
redhat/eap7-netty<0:4.1.34-2.Final_redhat_00002.1.el7ea
0:4.1.34-2.Final_redhat_00002.1.el7ea
redhat/eap7-picketbox<0:5.0.3-5.Final_redhat_00004.1.el7ea
0:5.0.3-5.Final_redhat_00004.1.el7ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00007.1.el7ea
0:2.5.5-20.SP12_redhat_00007.1.el7ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00007.1.el7ea
0:2.5.5-20.SP12_redhat_00007.1.el7ea
redhat/eap7-undertow<0:2.0.25-1.SP1_redhat_00001.1.el7ea
0:2.0.25-1.SP1_redhat_00001.1.el7ea
redhat/eap7-weld-core<0:3.0.6-2.Final_redhat_00002.1.el7ea
0:3.0.6-2.Final_redhat_00002.1.el7ea
redhat/eap7-wildfly<0:7.2.4-1.GA_redhat_00002.1.el7ea
0:7.2.4-1.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.6.4-1.Final_redhat_00001.1.el7ea
0:1.6.4-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-elytron-tool<0:1.4.3-1.Final_redhat_00001.1.el7ea
0:1.4.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-transaction-client<0:1.1.6-2.Final_redhat_00001.1.el7ea
0:1.1.6-2.Final_redhat_00001.1.el7ea
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el8ea
0:2.9.0-1.redhat_00005.1.el8ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el8ea
0:1.9.13-9.redhat_00006.1.el8ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el8ea
0:2.3.5-4.SP3_redhat_00002.1.el8ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el8ea
0:3.0.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el8ea
0:5.3.11-2.SP1_redhat_00001.1.el8ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el8ea
0:9.3.7-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.17-1.Final_redhat_00001.1.el8ea
0:1.4.17-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-annotations<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jackson-core<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jackson-databind<0:2.9.9.3-1.redhat_00001.1.el8ea
0:2.9.9.3-1.redhat_00001.1.el8ea
redhat/eap7-jackson-jaxrs-providers<0:2.9.9-2.redhat_00001.1.el8ea
0:2.9.9-2.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-base<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-java8<0:2.9.9-1.redhat_00001.1.el8ea
0:2.9.9-1.redhat_00001.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.23-1.Final_redhat_00001.1.el8ea
0:4.0.23-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-logging<0:3.3.3-1.Final_redhat_00001.1.el8ea
0:3.3.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-logmanager<0:2.1.14-1.Final_redhat_00001.1.el8ea
0:2.1.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-marshalling<0:2.0.9-1.Final_redhat_00001.1.el8ea
0:2.0.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-msc<0:1.4.8-1.Final_redhat_00001.1.el8ea
0:1.4.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.14-1.SP1_redhat_00001.1.el8ea
0:5.0.14-1.SP1_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.3.1-4.Final_redhat_00004.1.el8ea
0:1.3.1-4.Final_redhat_00004.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.3-1.Final_redhat_00001.1.el8ea
0:3.7.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-jgroups<0:4.0.20-1.Final_redhat_00001.1.el8ea
0:4.0.20-1.Final_redhat_00001.1.el8ea
redhat/eap7-narayana<0:5.9.6-1.Final_redhat_00001.1.el8ea
0:5.9.6-1.Final_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.34-2.Final_redhat_00002.1.el8ea
0:4.1.34-2.Final_redhat_00002.1.el8ea
redhat/eap7-picketbox<0:5.0.3-5.Final_redhat_00004.1.el8ea
0:5.0.3-5.Final_redhat_00004.1.el8ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00007.1.el8ea
0:2.5.5-20.SP12_redhat_00007.1.el8ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00007.1.el8ea
0:2.5.5-20.SP12_redhat_00007.1.el8ea
redhat/eap7-undertow<0:2.0.25-1.SP1_redhat_00001.1.el8ea
0:2.0.25-1.SP1_redhat_00001.1.el8ea
redhat/eap7-weld-core<0:3.0.6-2.Final_redhat_00002.1.el8ea
0:3.0.6-2.Final_redhat_00002.1.el8ea
redhat/eap7-wildfly<0:7.2.4-1.GA_redhat_00002.1.el8ea
0:7.2.4-1.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.6.4-1.Final_redhat_00001.1.el8ea
0:1.6.4-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-elytron-tool<0:1.4.3-1.Final_redhat_00001.1.el8ea
0:1.4.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-transaction-client<0:1.1.6-2.Final_redhat_00001.1.el8ea
0:1.1.6-2.Final_redhat_00001.1.el8ea
redhat/rh-sso7-keycloak<0:4.8.13-1.Final_redhat_00001.1.el6
0:4.8.13-1.Final_redhat_00001.1.el6
redhat/rh-sso7-keycloak<0:4.8.13-1.Final_redhat_00001.1.el7
0:4.8.13-1.Final_redhat_00001.1.el7
redhat/rh-sso7-libunix-dbus-java<0:0.8.0-2.el7
0:0.8.0-2.el7
redhat/rh-sso7-keycloak<0:4.8.13-1.Final_redhat_00001.1.el8
0:4.8.13-1.Final_redhat_00001.1.el8
redhat/rh-maven35-jackson-databind<0:2.7.6-2.7.el7
0:2.7.6-2.7.el7
debian/jackson-databind
2.9.8-3+deb10u32.9.8-3+deb10u52.12.1-1+deb11u12.14.0-1
Apple Xcode<13.3
13.3
fasterxml jackson-databind>=2.0.0<2.6.7.3
fasterxml jackson-databind>=2.7.0<2.7.9.6
fasterxml jackson-databind>=2.8.0<2.8.11.4
fasterxml jackson-databind>=2.9.0<2.9.9.2
Debian Debian Linux=8.0
NetApp Active Iq Unified Manager Linux>=7.3
NetApp Active Iq Unified Manager Windows>=7.3
NetApp Active Iq Unified Manager Vmware Vsphere>=9.5
NetApp OnCommand Workflow Automation
NetApp Service Level Manager
NetApp Snapcenter
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Fedoraproject Fedora=31
redhat JBoss Enterprise Application Platform=7.2
redhat JBoss Enterprise Application Platform=7.3
redhat OpenShift Container Platform=4.1
redhat Single Sign-on=7.3
redhat Enterprise Linux=7.0
redhat OpenShift Container Platform=3.11
redhat Enterprise Linux=6.0
redhat Enterprise Linux=8.0
Oracle Banking Platform=2.4.0
Oracle Banking Platform=2.4.1
Oracle Banking Platform=2.5.0
Oracle Banking Platform=2.6.0
Oracle Banking Platform=2.6.1
Oracle Banking Platform=2.7.0
Oracle Banking Platform=2.7.1
Oracle Communications Diameter Signaling Router=8.0.0
Oracle Communications Diameter Signaling Router=8.1
Oracle Communications Diameter Signaling Router=8.2
Oracle Communications Diameter Signaling Router=8.2.1
Oracle Communications Instant Messaging Server=10.0.1.3.0
Oracle Financial Services Analytical Applications Infrastructure>=8.0.2<=8.0.8
Oracle Goldengate Stream Analytics<19.1.0.0.1
Oracle JD Edwards EnterpriseOne Orchestrator=9.2
Oracle JD Edwards EnterpriseOne Tools=9.2
Oracle Primavera Gateway=15.2
Oracle Primavera Gateway=16.2
Oracle Primavera Gateway=17.12
Oracle Primavera Gateway=18.8.0
Oracle Primavera Unifier>=17.7<=17.12
Oracle Primavera Unifier=16.1
Oracle Primavera Unifier=16.2
Oracle Primavera Unifier=18.8
Oracle Retail Customer Management and Segmentation Foundation=17.0
Oracle Retail Xstore Point of Service=7.1
Oracle Retail Xstore Point of Service=15.0
Oracle Retail Xstore Point of Service=16.0
Oracle Retail Xstore Point of Service=17.0
Oracle Retail Xstore Point of Service=18.0
Oracle Siebel Engineering - Installer \& Deployment<=19.8
Oracle Siebel UI Framework<=19.10
Apple Xcode<13.3
redhat/jackson-databind<2.9.9.2
2.9.9.2
redhat/jackson-databind<2.10.0
2.10.0
redhat/jackson-databind<2.7.9.6
2.7.9.6
redhat/jackson-databind<2.8.11.4
2.8.11.4
IBM InfoSphere Data Architect<=9.2.1

Remediation

Patch Available

https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2

Patch Available

https://github.com/FasterXML/jackson-databind/issues/2387

Patch Available

https://www.oracle.com/security-alerts/cpuApr2021.html

Patch Available

https://www.oracle.com/security-alerts/cpuoct2020.html

Patch Available

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Information

The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

Event History

Jul 23, 2019
CVE Published
12:00 AM
Jul 29, 2019
CVE Published
via MITRE·11:42 AM
Data Sourced
via MITRE·11:42 AM
Description
Aug 1, 2019
Advisory Published
07:18 PM
Aug 5, 2019
Data Sourced
via Red Hat·02:59 PM
DescriptionSeverityAffected Software
Mar 4, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2019-14379?

CVE-2019-14379 is classified as a high severity vulnerability due to its potential for remote code execution.

2

How do I fix CVE-2019-14379?

To remediate CVE-2019-14379, upgrade to jackson-databind version 2.9.9.2 or later.

3

What causes CVE-2019-14379?

CVE-2019-14379 is caused by improper handling of polymorphic types during deserialization in jackson-databind.

4

Which software is affected by CVE-2019-14379?

CVE-2019-14379 affects multiple versions of FasterXML jackson-databind and related software that enables polymorphic type handling.

5

Can CVE-2019-14379 be exploited remotely?

Yes, CVE-2019-14379 can be exploited remotely if the vulnerable application allows untrusted data to be deserialized.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203