CVE-2019-14892

Aliases:GHSA-cf6r-3wgc-h863DEBIAN-CVE-2019-14892CGA-28cv-33w6-5763CGA-2p8w-qrfh-74v3CGA-2qgq-vgjq-fg4hCGA-2qxm-3qgw-xgc5CGA-4m45-98hr-p77fCGA-4mvm-c9x7-vcmxCGA-4wxr-5q6r-g7fqCGA-68q3-j272-2xj5CGA-692r-v9jv-q7hmCGA-6rfg-f5wr-f4rwCGA-6x89-9683-74gqCGA-6xvr-wp4x-m94fCGA-7cxx-cj57-6cxhCGA-7hmg-ghm8-f2x4CGA-7wqg-9x5v-46pvCGA-878c-wh8w-564jCGA-8h89-4743-mc3wCGA-93xm-vvcg-4w9rCGA-9hxv-274r-983cCGA-f35v-q7wx-2qpqCGA-f387-gw95-pgr7CGA-f8mc-x8gh-7m6rCGA-f987-884p-m497CGA-ffxr-qwpw-2262CGA-fqvq-69mh-5r47CGA-h5fw-ffjm-h87jCGA-hf85-pj55-f66jCGA-j895-6fm5-r4p6CGA-j8vw-q4pp-mhp3CGA-m2g7-c3g3-m3p6CGA-m6g3-x5qc-4295CGA-mhrp-8gw3-rq5xCGA-mm98-wfr3-rc4cCGA-p2j4-jfch-7j2xCGA-pcf4-725x-7j52CGA-pp7f-w986-3374CGA-vg32-25mr-hr38CGA-vx2q-684q-pv9qCGA-w25m-5mqx-2wr9CGA-xfpx-qhh6-wfwgCGA-3fv6-cjj8-fcx4CGA-3hrq-m49f-p559CGA-3pmx-v6jr-rmwhCGA-4w96-fcjq-x6f4CGA-6xp5-q4qf-796rCGA-7j4x-w3vw-rx2mCGA-7vff-r7c3-8hj9CGA-9275-33rx-hmw8CGA-c243-2qjx-x8qgCGA-cghp-xx29-m3hcCGA-fv5w-mfpg-85g7CGA-h7gx-p4hv-m99hCGA-hhv3-82w3-v7pgCGA-mcf3-gcg3-m9qqCGA-q766-9c38-ppm6CGA-qvcc-c34c-x474CGA-rcvm-3fpv-5gxmCGA-rx48-9258-6hhmCGA-vp58-m2rx-9vm3CGA-vppq-6g7r-55j3CGA-wm24-548g-v2w5CGA-wvvx-q3f4-7cx2CGA-x9pg-6r4q-3rh7CGA-xggm-gc4p-mq88CGA-xm9v-868c-wqg8CGA-xwmx-mqwx-4f82CGA-2v88-835m-m3jxCGA-38qj-72r8-w4wgCGA-3vh4-mx5p-gqmgCGA-4j8g-x9g9-qhgfCGA-4j8p-fggp-2hhwCGA-53jj-45f8-67xwCGA-5phf-v748-73m2CGA-6q4w-m8xv-2jjjCGA-6wmc-7xjq-j68xCGA-6wqx-jqr7-8255CGA-7996-v2qr-6pf8CGA-7gpv-7qhw-5hr9CGA-7xqp-3q5j-5wpjCGA-84v8-738w-4vm9CGA-8jc8-m937-h47fCGA-993w-9jr9-r4rpCGA-9w2x-5f37-jq7rCGA-cw86-8r29-mx34CGA-f3j8-wqxj-c93gCGA-f3p7-8mpg-2526CGA-g564-c459-92v8CGA-gcff-v2xw-r64pCGA-gfw2-xmg7-3rg4CGA-h7hp-3x2v-wp63CGA-hc5x-7px9-83f4CGA-hm5p-h52p-6hx3CGA-jcjv-qfm6-vp24CGA-jfgr-8f3g-7rxpCGA-mrrf-qf98-6j5xCGA-mv5f-rr6c-q2qrCGA-p566-g8w3-j54xCGA-pqw3-xq3x-cfrrCGA-q5mj-r2mx-qwx4CGA-qx78-r37w-ghwxCGA-v6qm-73m9-7h8wCGA-v8gr-3h4f-v38xCGA-w52h-p792-2rrmCGA-wpg5-hhrg-wqgwCGA-29hj-j3v8-2j8vCGA-32wh-fgqp-j867CGA-38xv-9rm9-g9j2CGA-3rr5-whrv-cm94CGA-5x3h-mw3h-96c5CGA-6qpx-f3hr-2x97CGA-8q79-m94g-j6mrCGA-952h-p5g9-mg4xCGA-9c9v-8v2p-7225CGA-9cxp-854m-mcjqCGA-9qf6-j955-qpq3CGA-c692-85rq-2577CGA-c9xf-9xgr-8g7fCGA-cqm8-wj65-3qg4CGA-fm3r-76qf-w32cCGA-ghhj-2gq2-p2pqCGA-h3p7-2pwm-4wvjCGA-jhfq-fqx3-vj5rCGA-mmhh-q85j-xqp8CGA-p7mj-4p47-63pxCGA-rx25-pqpw-5q43CGA-v3j3-8pj2-j982CGA-v997-4mg5-59q4CGA-w8q6-4965-75vqCGA-wp4p-gxx9-h2vhCGA-xfpp-2fc8-5cf3
Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 02 Mar 2020, 16:28
Last modified:05 Aug 2024, 00:26

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
5.62% LOW
6% probability +4.75%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Mar 2020, 16:28
Published
Vulnerability first disclosed
05 Aug 2024, 00:26
Last Modified
Vulnerability information updated

Description

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 5.62%• Percentile: 93%

Techniques & Countermeasures

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • apache•geode

    1.12.0

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

Showing first 50 affected entries in server-rendered view.

References (14)