CVE-2019-16942
Aliases:GHSA-mx7p-6679-8g3qDEBIAN-CVE-2019-16942CGA-2342-w85m-x46vCGA-2p56-hc2q-5c6jCGA-3fw3-2g69-wqq3CGA-4pm6-5f5g-v3rjCGA-7vf9-vg75-vj3jCGA-8hc3-82c4-phffCGA-92hr-xxmg-7326CGA-9f29-372r-q6g8CGA-9gf8-93rc-89p3CGA-9rrh-5x83-mrvfCGA-fj48-pqx2-2jfcCGA-g843-qrjr-9v83CGA-g93h-gp8j-mf7mCGA-gg4f-vph7-m5j2CGA-gpvp-wwf5-6rq7CGA-gv8r-2gx2-hxp2CGA-j577-g2qp-vqc3CGA-jgpp-2pw4-259xCGA-jq83-gm29-76cfCGA-m3q6-72rr-fp3wCGA-mhcm-328r-prq7CGA-mp29-mwfg-25f2CGA-p4rr-32v4-7hqrCGA-pwfw-8hj7-2cw4CGA-q3c4-pxgw-pmhgCGA-q97p-7r33-93gmCGA-q9cc-9h9r-89v5CGA-qjg8-g2cp-m99pCGA-qqgv-259p-4gpjCGA-r2pv-32j7-9q64CGA-r6h2-82g3-86hjCGA-r92v-c3rp-9x5fCGA-rc75-ccxq-r8w4CGA-rj56-88f9-7hwfCGA-vhp9-mjg6-3479CGA-vpw2-gv24-fx2mCGA-x586-cmjf-w7h8CGA-x68g-2wx3-qfq5CGA-x8j5-q366-fvx6CGA-xcc9-pg65-cgghCGA-xq6q-p7v9-cxccCGA-xqm5-g57r-9m5rCGA-2886-q5wv-p475CGA-29pg-9h5v-rcgrCGA-422f-3r49-2q77CGA-43mg-7qc5-6mqqCGA-483v-4r87-28fwCGA-4f78-7467-2wg8CGA-534r-34jj-fr6wCGA-8922-v6h9-f675CGA-8wpr-qgcj-4qvgCGA-93fw-5h4x-4jrrCGA-c29c-mg2j-42h3CGA-f5x5-mcf8-6rfgCGA-fr7f-ph9j-wcxmCGA-g3m9-v57h-6gr2CGA-g58q-rx6m-pq9hCGA-hcw4-4fq7-347xCGA-hmcr-3wf9-6mm7CGA-j82m-65cw-73wrCGA-jjwc-9h6j-523qCGA-m6gp-qf4w-8f44CGA-qg39-m37j-c24rCGA-qjgr-6gxf-jcx2CGA-rwh2-gg7p-qc9qCGA-wmmm-c79m-3784CGA-xg7q-jx3h-2rhvCGA-xj2f-m6wj-jfj6CGA-xrf7-8m9g-3gp5CGA-3pqj-fr6r-r47fCGA-42pm-wc45-2fxrCGA-44cp-727h-wcqwCGA-4q58-j2j3-fh93CGA-52c3-gxqj-34v4CGA-63q4-5j3v-wqmwCGA-6pjc-6562-hm56CGA-6qx4-h5fw-rhmfCGA-6rhr-4xpf-9g82CGA-757x-g263-x8mfCGA-784j-hm9f-j33cCGA-7f67-vwqh-8m6fCGA-7j37-r92w-xwmfCGA-7prf-3cw6-3998CGA-8q6j-pchm-f36wCGA-9m9h-9393-m79rCGA-c2w6-62rm-gj2hCGA-cwmv-cmv2-hfrgCGA-f2j2-25vg-7q3xCGA-f3g2-cfr8-8h2rCGA-f52r-pvmc-p75gCGA-h3fp-f84w-9fqmCGA-hvjg-jr8g-r72cCGA-jr6c-hhgj-qwxjCGA-jr7m-qmw4-wgpgCGA-jvrj-4f85-pxvmCGA-m3xc-25m5-gr2hCGA-m66x-p5j3-f666CGA-p5g2-gff5-jr37CGA-qgv4-vvgf-cm2qCGA-r245-93w8-pjw6CGA-r49p-72vg-2772CGA-rcv7-mjjc-phprCGA-rhxv-3vwh-74w5CGA-rm5j-p9xr-2r2jCGA-rqm4-h6j4-vp7hCGA-v96v-wjh4-q7c5CGA-vgf6-r69g-7q2jCGA-w5jm-x3fq-5fwvCGA-wm9r-6fhv-4h3cCGA-x387-jm2r-j5g3CGA-x9h8-2fjp-4v74CGA-2ffp-qwgh-rv3cCGA-394r-vxxr-6w85CGA-39v2-fxqw-427rCGA-4392-p7c9-7m95CGA-43px-qx95-7q56CGA-4f44-q69x-qh8cCGA-5f7g-hcq4-cmxhCGA-5hqj-q83q-gxh2CGA-6c7f-23qj-9xg5CGA-6v34-cjwc-frrgCGA-733w-w682-98jxCGA-7xf3-8cq8-p56mCGA-82mg-m4vw-5pgvCGA-82qj-39v9-4x69CGA-8ghg-qvfg-px55CGA-8v68-28xr-mhq2CGA-9ppj-3f2w-rh3rCGA-9qr8-6qrf-c5h7CGA-crhj-fqw9-xw35CGA-f69r-rh5c-rg55CGA-fm5p-wmjw-337xCGA-g572-5g7g-q8pxCGA-gc6j-9vx9-vwrjCGA-m3v2-5gwh-r46fCGA-m8g7-w6r6-6vq6CGA-q8xw-r82f-rg9vCGA-qccw-mx5m-hh4rCGA-qfp6-72q2-82jwCGA-v76h-v5gr-vjwcCGA-vm7x-rxhg-fg9rCGA-vm9g-h99c-whj5CGA-x98w-2qc7-vhmjCGA-xfw6-w3f7-cq75
Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 01 Oct 2019, 16:04
Last modified:05 Aug 2024, 01:24
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
5.73% LOW
6% probability +5.31%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
01 Oct 2019, 16:04
Published
Vulnerability first disclosed
05 Aug 2024, 01:24
Last Modified
Vulnerability information updated
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 5.73%• Percentile: 93%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-2.10
all
- chainguard•eco-java-gradle-2.11
all
- chainguard•eco-java-gradle-2.12
all
- chainguard•eco-java-gradle-2.13
all
- chainguard•eco-java-gradle-2.14
all
- chainguard•eco-java-gradle-2.14.1
all
- chainguard•eco-java-gradle-2.4
all
- chainguard•eco-java-gradle-2.5
all
- chainguard•eco-java-gradle-2.6
all
- chainguard•eco-java-gradle-2.7
all
- chainguard•eco-java-gradle-2.8
all
- chainguard•eco-java-gradle-2.9
all
- chainguard•eco-java-gradle-3.0
all
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
- chainguard•eco-java-gradle-5.4
all
Showing first 50 affected entries in server-rendered view.
References (48)
- https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html
- https://www.debian.org/security/2019/dsa-4542
- https://seclists.org/bugtraq/2019/Oct/6
- https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370%40%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5%40%3Cissues.geode.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
- https://access.redhat.com/errata/RHSA-2019:3901
- https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954%40%3Cissues.geode.apache.org%3E
- https://access.redhat.com/errata/RHSA-2020:0164
- https://access.redhat.com/errata/RHSA-2020:0159
- https://access.redhat.com/errata/RHSA-2020:0160
- https://access.redhat.com/errata/RHSA-2020:0161
- https://access.redhat.com/errata/RHSA-2020:0445
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://github.com/FasterXML/jackson-databind/issues/2478
- https://issues.apache.org/jira/browse/GEODE-7255
- https://security.netapp.com/advisory/ntap-20191017-0006/
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-16942
- https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b
- https://github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8
- https://github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac
- https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20191017-0006
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370@%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954@%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5@%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://github.com/FasterXML/jackson-databind
- https://security-tracker.debian.org/tracker/CVE-2019-16942