CVE-2019-14379 FasterXML jackson-databind
| Affected software | FasterXML jackson-databind |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 2.9.9.2, 2.8.11.4, 2.7.9.6 |
| Weakness | CWE-1321 |
| Published | 29 Jul 2019 |
| Updated | 8 Oct 2026 |
Description
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CWE-915
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 8.0% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE is covered by a multi-CVE ARMR patch rule |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2019-14379.armr patch rule, ARMR 2.6 added 2020-06-25 updated 2026-03-04How to mitigate CVE-2019-14379
Upgrade FasterXML jackson-databind to a release that fixes it: 2.9.9.2, 2.8.11.4 or 2.7.9.6. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle GoldenGate / Security / Application Adapters (jackson-databind, SLF4J, ZooKeeper, Apache Spark) (Prior to 19.1.0.0.1) Oracle's note: CVE-2019-14379 and other CVEs addressed by these patches are not exploitable in the Oracle GoldenGate product, thus the CVSS score is 0.0. |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Communications Applications / IDIH Visualization (jackson-databind) (8.0.0, 8.1.0, 8.2.0, 8.2.1) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Communications Applications / Presence-api (jackson-databind) (10.0.1.3.0) Oracle JD Edwards / E1 IOT Orchestrator Security (jackson-databind) (9.2) Oracle JD Edwards / Monitoring and Diagnostics SEC (jackson-databind) (9.2) Oracle Siebel CRM / EAI (jackson-databind) (19.10 and prior) Oracle Siebel CRM / Siebel Approval Manager (jackson databind) (19.8 and prior) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Construction and Engineering / Admin (jackson-databind) (15.2, 16.2, 17.12, 18.8) Oracle Construction and Engineering / Core (jackson-databind) (16.1, 16.2, 17.7-17.12, 18.8) Oracle Financial Services Applications / Infrastructure (jackson-databind) (2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.7.1) Oracle Financial Services Applications / Infrastructure (jackson-databind) (8.0.2-8.0.8) Oracle Retail Applications / Xenvironment (jackson-databind) (7.1, 15.0, 16.0, 17.0, 18.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | IDIH Visualization (jackson-databind) | 8.0.0, 8.1.0, 8.2.0, 8.2.1 | 8.0.0 · 8.1.0 · 8.2.0 · 8.2.1 |
| Oracle Communications Applications | Presence-api (jackson-databind) | 10.0.1.3.0 | 10.0.1.3.0 |
| Oracle Construction and Engineering | Admin (jackson-databind) | 15.2, 16.2, 17.12, 18.8 | 15.2 · 16.2 · 17.12 · 18.8 |
| Oracle Construction and Engineering | Core (jackson-databind) | 16.1, 16.2, 17.7-17.12, 18.8 | 16.1 · 16.2 · 18.8 |
| Oracle Financial Services Applications | Infrastructure (jackson-databind) | 8.0.2-8.0.8 | 2.4.0 · 2.4.1 · 2.5.0 · 2.6.0 · 2.6.1 · 2.7.0 · 2.7.1 |
| Oracle GoldenGate | Security / Application Adapters (jackson-databind, SLF4J, ZooKeeper, Apache Spark) | Prior to 19.1.0.0.1 | |
| Oracle JD Edwards | E1 IOT Orchestrator Security (jackson-databind) | 9.2 | 9.2 |
| Oracle JD Edwards | Monitoring and Diagnostics SEC (jackson-databind) | 9.2 | 9.2 |
| Oracle Retail Applications | Xenvironment (jackson-databind) | 7.1, 15.0, 16.0, 17.0, 18.0 | 7.1 · 15.0 · 16.0 · 17.0 · 18.0 |
| Oracle Siebel CRM | EAI (jackson-databind) | 19.10 and prior | |
| Oracle Siebel CRM | Siebel Approval Manager (jackson databind) | 19.8 and prior |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.fasterxml.jackson.core:jackson-databind |
2.9.0 | 2.9.9.2 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.8.0 | 2.8.11.4 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
0 | 2.7.9.6 |
unbounded |
Products and versions
25 products, 54 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apple | xcode | generic | ＜ 13.3 |
| osv | com.fasterxml.jackson.core | jackson-databind | generic | ＜ 2.7.9.6 · ≥ 2.8.0 and ＜ 2.8.11.4 · ≥ 2.9.0 and ＜ 2.9.9.2 |
| nvd | debian | debian linux | generic | 8.0 |
| nvd | fasterxml | jackson-databind | generic | ≥ 2.0.0 and ＜ 2.6.7.3 · ≥ 2.7.0 and ＜ 2.7.9.6 · ≥ 2.8.0 and ＜ 2.8.11.4 · ≥ 2.9.0 and ＜ 2.9.9.2 |
| nvd | fedoraproject | fedora | generic | 29 · 30 · 31 |
| nvd | netapp | active iq unified manager | generic | ≥ 7.3 · ≥ 9.5 |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | service level manager | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | oracle | banking platform | generic | 2.4.0 · 2.4.1 · 2.5.0 · 2.6.0 · 2.6.1 · 2.7.0 · 2.7.1 |
| nvd | oracle | communications diameter signaling router | generic | 8.0.0 · 8.1 · 8.2 · 8.2.1 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1.3.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.2 and ≤ 8.0.8 |
| nvd | oracle | goldengate stream analytics | generic | ＜ 19.1.0.0.1 |
| nvd | oracle | jd edwards enterpriseone orchestrator | generic | 9.2 |
| nvd | oracle | jd edwards enterpriseone tools | generic | 9.2 |
| nvd | oracle | primavera gateway | generic | 15.2 · 16.2 · 17.12 · 18.8.0 |
| nvd | oracle | primavera unifier | generic | 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8 |
| nvd | oracle | retail customer management and segmentation foundation | generic | 17.0 |
| nvd | oracle | retail xstore point of service | generic | 7.1 · 15.0 · 16.0 · 17.0 · 18.0 |
| nvd | oracle | siebel engineering - installer \& deployment | generic | ≤ 19.8 |
| nvd | oracle | siebel ui framework | generic | ≤ 19.10 |
| nvd | redhat | jboss enterprise application platform | generic | 7.2 · 7.3 |
| nvd | redhat | openshift container platform | generic | 3.11 · 4.1 |
| nvd | redhat | single sign-on | generic | 7.3 |
References
Timeline
Timeline
| Published | 2019-07-29 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2020-06-25 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |