CVE-2019-14439: Infoleak
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.4, 2.7.9.6, and 2.6.7.3. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Other sources
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-14439?
CVE-2019-14439 has a moderate severity rating due to potential security risks related to polymorphic typing in certain configurations of the Jackson-databind library.
How do I fix CVE-2019-14439?
To fix CVE-2019-14439, update jackson-databind to version 2.9.9.2, 2.8.11.4, 2.7.9.6, or 2.6.7.3 or higher.
What software is affected by CVE-2019-14439?
CVE-2019-14439 affects multiple versions of the FasterXML jackson-databind library across various applications, including those provided by Debian and IBM.
What types of attacks does CVE-2019-14439 enable?
CVE-2019-14439 allows attackers to exploit polymorphic typing issues, potentially leading to remote code execution on systems with vulnerable configurations.
Is it safe to use default typing in JSON endpoints after CVE-2019-14439?
Using default typing in JSON endpoints can be risky after CVE-2019-14439; it is advisable to avoid or limit its use unless the library is updated.