CVE-2019-14439

Aliases:GHSA-gwp4-hfv6-p7hwDEBIAN-CVE-2019-14439CGA-2g3c-4mfj-3gmrCGA-35ff-6c63-pxq4CGA-3cm6-5836-qhqwCGA-463p-f4px-h9mqCGA-67vx-f46q-7p99CGA-842w-v2q5-43whCGA-8pw2-w2c8-937mCGA-9wjc-f227-vjhcCGA-9x4r-v828-76m2CGA-cpv6-rpgm-vg4mCGA-crh4-xqjr-pgg5CGA-f4p3-9f77-9mxrCGA-f8hx-92c5-7fmhCGA-f9g2-5hfp-62g6CGA-fcc3-3hx3-79mgCGA-gp7f-8773-8m4jCGA-h2r4-94fc-799xCGA-hjp9-rchw-mjqwCGA-hr8j-6xg4-jf4gCGA-jf53-3j42-3x6jCGA-jfgg-p3mh-qghrCGA-jjq9-pvg6-wxc7CGA-jrx9-pr8r-2978CGA-jvjw-5c24-224mCGA-jw6x-2645-ggg5CGA-mcjv-fx6j-9fp2CGA-mxvv-jvwj-rww9CGA-q2x4-4g72-8wv7CGA-r383-wx6c-652jCGA-r6vw-w9v8-4xm8CGA-r8q7-fqpq-hxpvCGA-r8rj-gx7g-x62rCGA-rxx4-89q3-c5wxCGA-v3qp-jq3f-5jphCGA-v968-8f8h-fj36CGA-vm82-82jw-7r36CGA-w7gf-rgcq-gh52CGA-wmrh-3xrw-3qpvCGA-x273-rxjx-744gCGA-x98m-vphv-g8f8CGA-2fwx-fjh6-rj8mCGA-39hh-mqx3-7q4xCGA-3x2v-5mh2-xcvmCGA-5g8x-crr3-87pgCGA-6225-33ff-f67hCGA-6m2v-f2w5-mf8jCGA-7gvf-c83p-8gc9CGA-7x8j-r72x-h95hCGA-9xxx-2fj9-pfr2CGA-c55g-q3xc-6w84CGA-g27f-jv4j-3rgqCGA-g4wh-h2vx-cg8pCGA-h67m-3fvr-xgcfCGA-hc9q-hpmv-cqmwCGA-jx3c-fpj8-gccqCGA-mjpr-6jh2-wrcvCGA-mv6p-5ph3-f456CGA-pgp5-jr3f-4pwxCGA-qqfp-38f3-4j27CGA-r3x8-m685-c3f8CGA-v4vv-x45v-gxw3CGA-v75h-qxxv-7558CGA-vpx8-mr7j-3488CGA-32p7-3xqm-44g3CGA-37q5-rhv9-ff32CGA-3835-3hcj-xrpfCGA-449p-j3wp-89xcCGA-46x2-727w-h27rCGA-4gfj-448p-r749CGA-654j-v59v-ghjjCGA-6777-p89w-p39pCGA-6fgf-j9r8-9gfcCGA-88mv-v233-hpx8CGA-8gm9-6425-8697CGA-8prx-gq8g-gmg2CGA-9gv9-97p8-865vCGA-9xwp-rhqw-m582CGA-cjj5-36qm-6hqmCGA-cpm8-jhff-q7h5CGA-f858-pj9m-r2j7CGA-fv7r-pjg3-5jpqCGA-gqgf-wmfv-qv5jCGA-gxpr-qx43-pj6gCGA-hpfj-8pp6-wm75CGA-j734-456m-gw79CGA-j7f4-wjjx-ff83CGA-m8x2-3pr3-4335CGA-mhh2-cx28-3356CGA-mj4v-rjff-r2p2CGA-mwjj-pv74-pfqfCGA-p59m-j9p7-75vfCGA-p8mc-7v6h-mc7wCGA-pchg-27j8-gx8wCGA-pv6r-6h3j-q286CGA-q3v9-67pg-qfcjCGA-q5hc-59x2-q246CGA-v6mh-rp3j-cc95CGA-vj9v-33gh-r5wvCGA-w2p7-7qvc-j7wmCGA-wg9j-jc37-qrrxCGA-wwqf-g6vj-jjwwCGA-2xh6-gpr5-gqf7CGA-3685-wx77-x9mfCGA-3wwr-w6g9-wgqrCGA-4552-746r-2pc8CGA-46q3-rhfc-w69mCGA-4p9w-wwh2-6745CGA-58p9-rhjx-58ghCGA-5cpw-7cr3-cqmcCGA-5fg3-mqwp-7hgvCGA-86ww-hwp5-vh9rCGA-87qq-phm6-8jx7CGA-88gp-99m7-fxggCGA-9cvw-6pr7-942cCGA-9pj2-337m-pfr5CGA-9w6h-rx67-whrvCGA-c529-mr4m-w9q7CGA-fc3h-98cf-xw5rCGA-fvhj-r293-c998CGA-gvh9-65xr-wqhrCGA-gx29-rh9g-c87pCGA-gx7v-5f4c-qc98CGA-hhjx-h787-c4q3CGA-prfx-w2m7-38frCGA-rhpj-mfhp-vwmjCGA-rwc4-c69h-r74fCGA-vhjp-2j3m-jr5mCGA-vpw3-jmgp-xfvwCGA-w8q9-vqcm-535fCGA-x38p-w3gf-6p5w
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 30 Jul 2019, 10:49
Last modified:05 Aug 2024, 00:19

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
10.85% MEDIUM
11% probability +0.53%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Jul 2019, 10:49
Published
Vulnerability first disclosed
05 Aug 2024, 00:19
Last Modified
Vulnerability information updated

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 10.85%• Percentile: 96%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • apache•drill

    1.16.0

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

Showing first 50 affected entries in server-rendered view.

References (50)