Yüksek CVSS 7.5

CVE-2019-14439: Jackson-databind: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: 30 Temmuz 2019 14:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: %10,85 (yüzdelik 96)
CWE: CWE-502
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.0.0	—	2.6.7.3
fasterxml-jackson-databind	2.7.0	—	2.7.9.6
fasterxml-jackson-databind	2.8.0	—	2.8.11.4
fasterxml-jackson-databind	2.9.0	—	2.9.9.2
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
debian-debian-linux	10.0	10.0	—
fedoraproject-fedora	29	29	—
fedoraproject-fedora	30	30	—
apache-drill	1.16.0	1.16.0	—
redhat-jboss-middleware-text-only-advisories	1.0	1.0	—
oracle-banking-platform	2.4.0	2.4.0	—
oracle-banking-platform	2.4.1	2.4.1	—
oracle-banking-platform	2.5.0	2.5.0	—
oracle-banking-platform	2.6.0	2.6.0	—
oracle-banking-platform	2.6.1	2.6.1	—
oracle-banking-platform	2.7.0	2.7.0	—
oracle-banking-platform	2.7.1	2.7.1	—
oracle-communications-diameter-signaling-router	8.0.0	8.0.0	—
oracle-communications-diameter-signaling-router	8.1	8.1	—
oracle-communications-diameter-signaling-router	8.2	8.2	—
oracle-communications-diameter-signaling-router	8.2.1	8.2.1	—
oracle-communications-instant-messaging-server	10.0.1.3.0	10.0.1.3.0	—
oracle-financial-services-analytical-applications-infrastructure	8.0.2	8.0.8	—
oracle-global-lifecycle-management-opatch	—	—	11.2.0.3.23
oracle-global-lifecycle-management-opatch	12.2.0.1.0	—	12.2.0.1.19
oracle-global-lifecycle-management-opatch	13.9.4.0.0	—	13.9.4.2.1
oracle-global-lifecycle-management-opatch	11.2.0.3.23	11.2.0.3.23	—
oracle-global-lifecycle-management-opatch	13.9.4.2.1	13.9.4.2.1	—
oracle-goldengate-stream-analytics	—	—	19.1.0.0.1

Kaynaklar

Uygulamada aç Tüm CVE kayıtları