CVE-2019-10202: redhat codehaus Deserialization of Untrusted Data
Vulnerability summary
CVE-2019-10202 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in redhat codehaus. EPSS estimates a 5.17% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.
Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 5Timeline
- 01-10-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.17%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.17% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard7 products
- hadoop-fips-3.3.6< 3.3.6-r15
- spark-3.5-scala-2.12All versions (No fix recorded)
- spark-3.5-scala-2.13< 3.5.9-r10 | All versions (No fix recorded)
- spark-4.0-scala-2.13All versions (No fix recorded)
- spark-fips-3.5-scala-2.12< 3.5.8-r14 | All versions (No fix recorded)
Redhat2 products
- codehausCodehaus 1.9.x
- jboss_enterprise_application_platform7.2.0
Wolfi2 products
- spark-4.0-scala-2.13All versions (No fix recorded)
- tezAll versions (No fix recorded)
Org.codehaus.jackson1 product
- jackson-mapper-asl≤ 1.9.13
4 vendors · 12 products
References
18 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10202X Refsource CONFIRMIssue TrackingVendor AdvisoryREPORTWEB
