Kritik CVSS 9.8

CVE-2019-14379: Jackson-databind: prototip kirliliği

Yayın: 29 Temmuz 2019 15:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %8,11 (yüzdelik 95)
CWE: CWE-1321
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.0.0	—	2.6.7.3
fasterxml-jackson-databind	2.7.0	—	2.7.9.6
fasterxml-jackson-databind	2.8.0	—	2.8.11.4
fasterxml-jackson-databind	2.9.0	—	2.9.9.2
debian-debian-linux	8.0	8.0	—
netapp-active-iq-unified-manager	7.3	—	—
netapp-active-iq-unified-manager	7.3	—	—
netapp-active-iq-unified-manager	9.5	—	—
netapp-oncommand-workflow-automation	—	—	—
netapp-service-level-manager	—	—	—
netapp-snapcenter	—	—	—
fedoraproject-fedora	29	29	—
fedoraproject-fedora	30	30	—
fedoraproject-fedora	31	31	—
redhat-jboss-enterprise-application-platform	7.2	7.2	—
redhat-jboss-enterprise-application-platform	7.3	7.3	—
redhat-openshift-container-platform	4.1	4.1	—
redhat-single-sign-on	7.3	7.3	—
redhat-openshift-container-platform	3.11	3.11	—
redhat-jboss-enterprise-application-platform	7.2	7.2	—
redhat-jboss-enterprise-application-platform	7.3	7.3	—
redhat-single-sign-on	7.3	7.3	—
redhat-jboss-enterprise-application-platform	7.2	7.2	—
redhat-jboss-enterprise-application-platform	7.3	7.3	—
redhat-single-sign-on	7.3	7.3	—
oracle-banking-platform	2.4.0	2.4.0	—
oracle-banking-platform	2.4.1	2.4.1	—
oracle-banking-platform	2.5.0	2.5.0	—
oracle-banking-platform	2.6.0	2.6.0	—
oracle-banking-platform	2.6.1	2.6.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları