CVE-2019-14540
Aliases:GHSA-h822-r4r5-v8jgDEBIAN-CVE-2019-14540CGA-24x3-wfc9-5qm8CGA-27g4-rpxw-jqxrCGA-2wr8-rhjq-j67rCGA-3cmx-pmg2-hmpwCGA-4gc8-wp9w-22f8CGA-4q44-cg9q-3r67CGA-59p7-ggjc-wh37CGA-5cjc-f4p6-j9vjCGA-5j76-rjrp-43cpCGA-5x6x-m935-gh3wCGA-65r8-rwcf-8v6wCGA-664j-2pj5-5ggjCGA-6mrq-m27q-mf66CGA-6wj8-c647-3vj3CGA-723f-w5fw-gvrpCGA-774c-r5vh-crvjCGA-7j7q-gx98-qhx7CGA-85hm-2j65-hh58CGA-8cwq-4fr7-4ccmCGA-8wc7-wq9m-c4pwCGA-9cfx-ffhj-r322CGA-9j6w-3cv8-3jwqCGA-9p7f-85xg-qc55CGA-g6qp-hfw5-56g6CGA-gq2q-f2rg-jjfpCGA-gq78-58xq-753vCGA-h3xf-x4hx-vfx9CGA-h885-mx8j-fcfpCGA-hch2-w5mc-8qh7CGA-hf29-jjcq-g85mCGA-jf88-5x2r-jmxhCGA-jp5v-wgvc-w5gxCGA-mqvp-3m8h-mm72CGA-p724-hqgw-xc2jCGA-prh8-p7mh-c7h8CGA-q7pq-g9v7-pq4vCGA-q8jf-g8wj-fp72CGA-q8v8-5jcf-p66qCGA-qqf8-hqvr-76h3CGA-qx55-44cq-wq72CGA-r53g-9g62-f52wCGA-r5wx-mp6h-5v22CGA-r692-rqcr-8699CGA-rcxf-83cw-2588CGA-v3m7-5mrf-x6wjCGA-vjmc-4mfm-49g3CGA-vq3q-725v-vr7pCGA-vr4h-mqgq-48ffCGA-w6c9-499q-jcrhCGA-wvqr-8jrh-4m7vCGA-xj76-f5gp-mxjpCGA-xjv2-5pm4-32g7CGA-2j3w-v575-34jqCGA-2qwg-hg99-4w8hCGA-2x4h-83rh-gqr7CGA-5rh7-vjph-mp8hCGA-5wm7-q3f3-cmf2CGA-6xm9-c9ph-wf5qCGA-89wm-pf8m-wx3hCGA-8qfj-g8g4-f67vCGA-9qx2-gj3r-9464CGA-9w5m-hwf6-rq2hCGA-cmmh-hq32-26q3CGA-h8jm-fvmq-5h3qCGA-hpm2-rm38-g377CGA-j3m8-f59g-5fp4CGA-p5cj-cj7w-p756CGA-prfj-xqjg-6h3mCGA-pv45-gvxj-2rqgCGA-qh5f-gh3c-8fmrCGA-qw4c-723m-5vc2CGA-r54m-r6vp-pgx8CGA-rmwh-5h35-f94hCGA-w9ww-62wh-wc6fCGA-wvxv-v7f7-5rpjCGA-26p7-g7j7-p9q4CGA-2fjc-8vv7-4566CGA-3cfj-652v-r5gmCGA-55wh-qcc3-jhq5CGA-5m7q-gp65-f7g4CGA-64hj-88h5-2qgrCGA-76h5-jrv3-gv8gCGA-85qm-j74q-4jwxCGA-8hp4-ghvm-q9h8CGA-c7c7-mpf4-fr4mCGA-cpjh-82j6-6h8xCGA-f6hc-4vwq-xv89CGA-g24m-xgjr-w8c8CGA-g87x-rgh3-q6xqCGA-gpwg-2mvh-p2vcCGA-gqj8-h7xp-4qxvCGA-h36c-5gvh-8wpjCGA-h927-v4pc-7fqwCGA-hhgh-23ph-gfr6CGA-hp2j-x2vf-4pxmCGA-j2j8-cw49-86ffCGA-jj2h-9gf4-6hg2CGA-jm5q-8ggj-34h9CGA-jmgm-mjv5-v272CGA-jrcf-jc9h-377jCGA-mgc2-rv94-6mfpCGA-mqm8-pxxf-663fCGA-pf5v-646f-5fxfCGA-qcvw-7w55-w3m5CGA-qwq5-8mc5-c66rCGA-rg2r-vhx9-cjhgCGA-rhf3-p49p-87x2CGA-wpg5-m7c5-mq7vCGA-ww76-r8c5-9mcrCGA-x7hp-fv6r-rfw9CGA-xc86-5vfj-r4wcCGA-xf63-64r4-qg8cCGA-xg3p-v4qq-6376CGA-248p-xvc2-vjqcCGA-268v-wprh-7c4fCGA-2cq2-rq55-5329CGA-379x-c26p-jf9qCGA-3vhh-w6mw-5h4wCGA-4mgv-27gh-5r2wCGA-6crx-xjxp-h576CGA-723w-hm52-r7xwCGA-7qpw-7mmx-qgpgCGA-8v87-fq2x-cw9rCGA-9fc8-9cv6-2qxfCGA-9qr6-m37h-9233CGA-c5j6-cwfp-65pgCGA-cv62-8vrm-pc86CGA-g9w4-j5xw-pcv4CGA-gm95-jq4h-667fCGA-h65p-g5qr-g5qpCGA-hmh8-jmfw-r5hhCGA-hpvh-whmv-r7rpCGA-j4m6-4w95-25m2CGA-jgcq-vrwp-hp4mCGA-mvjj-gq6x-c87wCGA-p4q5-9wgj-4wg3CGA-qgrv-2c4j-gcf8CGA-rpjj-qg28-q6xhCGA-wh2m-8p4q-5gqhCGA-x8fp-76v8-4jfxCGA-xvw9-f2f2-mf4xCGA-xw54-fr24-cgv3
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 15 Sept 2019, 21:45
Last modified:05 Aug 2024, 00:19
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
10.76% MEDIUM
11% probability +3.68%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
15 Sept 2019, 21:45
Published
Vulnerability first disclosed
05 Aug 2024, 00:19
Last Modified
Vulnerability information updated
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 10.76%• Percentile: 96%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
- chainguard•eco-java-gradle-5.4
all
Showing first 50 affected entries in server-rendered view.
References (58)
- https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E
- https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5d377f8d7ccce6%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html
- https://www.debian.org/security/2019/dsa-4542
- https://seclists.org/bugtraq/2019/Oct/6
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3200
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/errata/RHSA-2020:0161
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://access.redhat.com/errata/RHSA-2020:0445
- https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://github.com/FasterXML/jackson-databind/issues/2449
- https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x
- https://github.com/FasterXML/jackson-databind/issues/2410
- https://security.netapp.com/advisory/ntap-20191004-0002/
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-14540
- https://github.com/FasterXML/jackson-databind/commit/73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db
- https://github.com/FasterXML/jackson-databind/commit/d4983c740fec7d5576b207a8c30a63d3ea7443de
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT
- https://security.netapp.com/advisory/ntap-20191004-0002
- https://github.com/FasterXML/jackson-databind
- https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E
- https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5d377f8d7ccce6@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@%3Cissues.hbase.apache.org%3E
- https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@%3Ccommits.hbase.apache.org%3E
- https://security-tracker.debian.org/tracker/CVE-2019-14540