CVE-2019-12384

Aliases:GHSA-mph4-vhrx-mv67RHSA-2019:1820RHSA-2019:2720DEBIAN-CVE-2019-12384CGA-2325-8xxr-mf2qCGA-2354-rm47-89q5CGA-2w4g-52cw-6gccCGA-3jhx-fmq5-rwwvCGA-478f-335g-9rhfCGA-4m25-mp39-h2v3CGA-585w-2925-vj8rCGA-5prc-jm8x-3wf5CGA-6h6h-rjv8-9h2mCGA-6wjf-58xj-pf2fCGA-7fpg-498h-49g6CGA-86p6-6799-pvfpCGA-9c88-wvx5-7m2xCGA-c2pf-v9gq-cp9jCGA-c722-83pm-386gCGA-cp4g-gjv2-v3wvCGA-cqm2-h368-vrm9CGA-f5fc-qhm4-2c2vCGA-fc2p-28wr-8v5xCGA-ff8p-8jm9-jx64CGA-gq2g-7428-xhwrCGA-h44r-mw6h-ggxxCGA-h66f-whq2-f42fCGA-h864-mh7q-974wCGA-hcvg-83wr-2p7rCGA-hmm4-rqwv-6wf4CGA-hvxj-63jw-jgqpCGA-j3x2-x44g-v846CGA-jwwm-xq88-793fCGA-p8pr-mcpp-g44jCGA-pfpv-2m2v-2pxjCGA-ph7f-93qq-22h7CGA-qf3v-72hr-fwj7CGA-qvcr-5q32-f5v5CGA-r8fg-593h-6f54CGA-w427-57gp-wg37CGA-w4w5-5fhj-ffpgCGA-wq9v-4vhf-xp82CGA-x5vr-cj58-83wjCGA-xpvp-rv53-6x35CGA-2hhw-fgfc-577fCGA-3c9c-vv5h-25jcCGA-3pcp-rxq3-r64qCGA-6xc9-7fc3-9hq7CGA-7hf7-82jq-h28jCGA-7pqh-6hf4-3p7xCGA-7rg7-7fvv-p666CGA-82f7-v5fm-vcr7CGA-8v23-3cvr-7vj2CGA-99pj-6f7v-r7h4CGA-c4r6-p363-xrqgCGA-cff5-7q82-ffhrCGA-cp8c-pqgr-v53vCGA-h6c5-w468-m2c5CGA-pc7x-w9m2-cx37CGA-rjpc-7q88-pm9pCGA-v2xj-j999-v4v3CGA-w896-v2q5-8h77CGA-wqrr-93fp-x94mCGA-wwmc-777x-6fh4CGA-3fj9-p9w5-3gpqCGA-3j8v-8rjr-jx25CGA-4xr8-qggq-fwwwCGA-564f-7jjw-8rgjCGA-5j3w-x29c-xqj6CGA-779j-cfgq-6hjrCGA-7xvg-345r-xpqvCGA-8c8j-6qp2-53v6CGA-928h-phpv-fw64CGA-9598-q24h-xqh5CGA-9h98-x82g-98rcCGA-c9jm-qc32-289gCGA-c9px-858g-fvwpCGA-f87h-78rj-xqw3CGA-fc6h-fc3h-9m4hCGA-fq73-v496-9j7fCGA-h737-vjgh-w66xCGA-hm2f-9q27-wxg3CGA-hr62-3m6f-jfr5CGA-j2vg-5vc7-rxw9CGA-jhwr-6vx2-phh7CGA-jrrc-5233-3h96CGA-mhgq-p3ch-jxcgCGA-mprh-7f2f-jp9cCGA-pc6g-rm48-3jjgCGA-pc98-xc9m-wh2vCGA-rjr3-rcr9-vm2jCGA-vj29-cq3m-ww7fCGA-vr76-cqvh-jgp8CGA-w968-ppcw-7fh2CGA-w9rr-rwvv-9958CGA-wqjv-vc53-gj3rCGA-wx2v-rj64-w6q5CGA-x5x9-7gmm-6g28CGA-x9mw-rp9h-5x97CGA-xpjc-m3x9-g67jCGA-xx96-mx4x-wcrxCGA-xxgx-hvc3-g993CGA-258j-6586-gwm8CGA-2v3c-rmcv-5h86CGA-339g-626r-6hxcCGA-3c69-r4p7-wvjxCGA-4xjm-737x-r29wCGA-5ghc-6f7r-cxg5CGA-659w-32c2-6r4wCGA-68vg-wrvg-c4rfCGA-6pgm-9g23-rcjfCGA-8947-cv5g-5c7mCGA-9cm3-rv5j-4955CGA-cpmc-g4gr-6rm3CGA-fh3c-mqfj-5673CGA-fxhx-h54m-f9x9CGA-gpvx-m9mj-rwg4CGA-grgf-p4vv-7mjrCGA-h32q-6m25-f57cCGA-hjf4-rw88-5mvxCGA-j4jc-g25m-g3gwCGA-jm8w-mpxq-mp24CGA-m4cw-m88x-75fxCGA-m98w-5jvw-h5x9CGA-mggv-73wm-xpgrCGA-p2r9-85wr-f3jwCGA-p6g2-v38f-8hr8CGA-pq8h-hjpx-5mqqCGA-rxrp-f7pj-qvh3CGA-w684-9fg2-5fgmCGA-wvpv-3vw3-25m8CGA-x8pw-5q9h-5wc4CGA-xmj5-jf3w-56f5CGA-xwrf-6mgc-7qmx
Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 24 Jun 2019, 15:34
Last modified:04 Aug 2024, 23:17

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
5.9 MEDIUM
v3.1 (nvd)
EPSS Score
45.2% HIGH
45% probability -6.47%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Jun 2019, 15:34
Published
Vulnerability first disclosed
04 Aug 2024, 23:17
Last Modified
Vulnerability information updated

Description

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v3.0•HIGH•Score: 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 45.20%• Percentile: 99%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

Showing first 50 affected entries in server-rendered view.

References (76)