CVE-2019-14892

Aliases:GHSA-cf6r-3wgc-h863
Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 02 Mar 2020, 16:28
Last modified:05 Aug 2024, 00:26

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
0.9% LOW
1% probability +0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Mar 2020, 16:28
Published
Vulnerability first disclosed
05 Aug 2024, 00:26
Last Modified
Vulnerability information updated

Description

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.90%• Percentile: 76%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

  • apache•geode

    1.12.0

  • fasterxml•jackson-databind

    ≥ 2.0.0, < 2.6.7.3 | ≥ 2.7.0, < 2.8.11.5 | ≥ 2.9.0, < 2.9.10

  • com.fasterxml.jackson.core•jackson-databind

    < 2.6.7.3 | ≥ 2.7.0, < 2.8.11.5 | ≥ 2.9.0, < 2.9.10

  • red hat•jackson-databind

    Versions before 2.9.10 | Versions before 2.8.11.5 | Versions before 2.6.7.3

  • redhat•decision_manager

    7.0

  • redhat•jboss_data_grid

    na | 7.0.0

  • redhat•jboss_enterprise_application_platform

    7.0

  • redhat•jboss_fuse

    7.0.0

  • redhat•openshift_container_platform

    4.3

  • redhat•process_automation

    7.0

References (13)