CVE-2019-17267: debian debian_linux Deserialization of Untrusted Data
Modified
AliasesUBUNTU-CVE-2019-17267DEBIAN-CVE-2019-17267CGA-254h-276p-6jq4CGA-2fj9-3w9r-pgmxCGA-2p9f-79vc-w62wCGA-32rr-vqqq-85qgCGA-34wg-hj2q-4wvmCGA-36g3-9qxc-7mv2CGA-37v4-5v9h-5fp3CGA-3c89-4x84-r9ffCGA-3fq7-c7h9-pv79CGA-3gh4-5m7g-5r8rCGA-3qfm-fpqj-mfg2CGA-3qqr-67mh-8475CGA-3v34-46fm-ch7gCGA-4458-8cpp-vg27CGA-4g84-j2jq-fjcjCGA-52jc-2wp3-r897CGA-59m3-5cf3-m8v6CGA-6478-3mwx-p646CGA-654q-ggx9-c53qCGA-69gc-9r3r-5wwqCGA-6rv5-vf2p-474hCGA-737f-3pwc-5hqgCGA-73j8-64c8-4f6xCGA-745m-39f6-9f8qCGA-79jp-v8h7-2w2gCGA-79pc-ccfr-268cCGA-7cx3-p4vp-vgwvCGA-7rvw-5h4m-xp64CGA-7w2h-pf72-gvwjCGA-7w92-fp7q-677jCGA-7wxq-h87q-v839CGA-85hj-7xmp-vhhhCGA-8c67-c638-g65xCGA-8f3h-vp34-p742CGA-8pqx-32px-j32wCGA-8pvp-6rv5-352rCGA-8v5c-5p3m-g23hCGA-8vph-jjpw-x79mCGA-8xhh-8rcj-xgq9CGA-934x-286r-q83rCGA-9354-q6c2-v3mpCGA-93w2-j8fp-qw95CGA-9439-j74c-pcfhCGA-9fhm-222g-38cwCGA-9rxj-f62w-cqwhCGA-9v3h-5m2w-v95jCGA-9wv2-w3jp-wj5fCGA-c3h2-cvx9-86v7CGA-c3hp-4c7c-4p72CGA-c67m-5fx6-hvq3CGA-cfpp-2526-f55qCGA-cpjw-gpp3-52ffCGA-cwfg-mhj7-85w4CGA-f8rp-vqpx-w8j9CGA-fg32-c8rh-248gCGA-fm8q-xhf3-qcmwCGA-fmr8-828h-34rpCGA-fqf6-j4vj-vq7gCGA-fvc7-73x2-25g6CGA-fwjh-ff2p-2r47CGA-g2h9-89wg-9h29CGA-g34m-f3p9-gg4mCGA-g5g3-55pq-2f7gCGA-gc4h-rgfw-2f36CGA-ghh7-j9x6-p6c5CGA-gm2f-gp3w-hwwgCGA-gpvg-vxcv-6h7qCGA-h2jr-27q2-cj7hCGA-h3g6-q7j9-x756CGA-h5pg-7842-q2ppCGA-h6jc-5mpv-hqjqCGA-h7h3-cv28-vcjjCGA-h8pf-74hp-hpjxCGA-hcp7-gch5-5hhjCGA-hcx8-vp5r-29pwCGA-hggj-mq7g-mq3vCGA-hjv3-hfmw-fpxvCGA-hr6m-2m8v-7p5gCGA-hx9q-pg5w-55rpCGA-j3f2-p9p6-qjp5CGA-j59h-g827-fgm7CGA-j67w-g8q7-3xr8CGA-j6f7-hf26-f5jqCGA-j73p-wm8x-6gwhCGA-j7qx-6p25-h364CGA-j85f-j45f-q4f5CGA-jjwp-74fc-74p6CGA-jrjf-4wm6-hf84CGA-jw55-hqp7-5249CGA-jwjr-5f5h-6945CGA-m5f6-j7x4-qhm3CGA-mpg7-48qg-mjwxCGA-mqcg-xw8g-9qj2CGA-mrjx-5jv8-62wqCGA-p25r-r555-4366CGA-p53q-h2h8-7p5fCGA-p5ww-4p9q-c9vfCGA-pfx6-fp6f-cwq5CGA-pv72-h763-p3qfCGA-pvrr-pr5h-2jgjGHSA-f3j5-rmmp-3fc5CGA-pxj3-7v5w-8xfrCGA-q32c-7q4p-86ccCGA-q3rj-g8gw-6ggrCGA-q5jj-8ppx-mxjvCGA-q6g4-7456-55cmCGA-q787-36m6-c6pjCGA-qfch-xxmp-mgx7CGA-qh4f-rc7g-fm85CGA-r833-9vxf-5xm7CGA-rc3m-7q8j-w8f6CGA-rp35-8jf9-7mrrCGA-rqh2-4rqx-pm2mCGA-rqp6-5gv8-65fqCGA-rv7h-c7qf-rhx2CGA-rwwh-35q4-gmrhCGA-rxjp-h7j2-j44vCGA-v298-php5-vq6wCGA-v5f5-x29f-3h54CGA-v98r-qfwc-h4r3CGA-vjcw-cmqr-v6mvCGA-vqv3-r475-xq73CGA-vwhj-9253-m884CGA-wp3w-qhhj-rmj3CGA-wpx6-j8pm-5557CGA-ww5j-98qq-g39pCGA-wwp8-6q24-hhfvCGA-xpv2-j25g-r562CGA-xq48-46qm-484qCGA-xvp2-9jh3-pjrvCGA-xvqg-9fg4-78m9
Published 06-10-2019Last modified 07-10-2026
Vulnerability summary
CVE-2019-17267 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 4.63% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
4.63%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 1Timeline
- 06-10-2019PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
CVSS metrics
7 scores · 6 sources · 2 versionsCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.63%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.63% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard61 products
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
- eco-java-gradle-2.12All versions (No fix recorded)
- eco-java-gradle-2.13All versions (No fix recorded)
- eco-java-gradle-2.14All versions (No fix recorded)
Netapp5 products
- active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- oncommand_api_servicesna
- oncommand_workflow_automationna
- service_level_managerna
- steelstore_cloud_integrated_storagena
Oracle4 products
Debian2 products
- jackson-databind< 2.10.0-1
- debian_linuxEOL8.0
Com.fasterxml.jackson.core1 product
- jackson-databind≥ 2.9.0, < 2.9.10 | < 2.8.11.5
Fasterxml1 product
- jackson-databind≥ 2.0.0, < 2.8.11.5 | ≥ 2.9.0, < 2.9.10
Redhat1 product
Ubuntu1 product
- jackson-databindAll versions (No fix recorded) | < 2.4.2-3ubuntu0.1~esm2
8 vendors · 76 products
References
35 links- access.redhat.com/errata/RHSA-2019:3200Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2019/12/msg00013.htmlMailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory- access.redhat.com/errata/RHSA-2020:0164Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0159Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0160Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2020:0161Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
Show all 35 references
- access.redhat.com/errata/RHSA-2020:0445Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- github.com/FasterXML/jackson-databind/issues/2460X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
- github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
