CVE-2019-14439
- Source
- https://cve.org/CVERecord?id=CVE-2019-14439
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-14439.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-14439
- Aliases
- Downstream
- Related
- Published
- 2019-07-30T11:15:11.123Z
- Modified
- 2026-06-11T14:08:25.829729Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "8.0.2" }, { "last_affected": "8.0.8" } ], "cpes": [ "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*" ], "vendor_product": "oracle:financial_services_analytical_applications_infrastructure", "source": "CPE_RANGE" }, { "extracted_events": [ { "fixed": "11.2.0.3.23" }, { "introduced": "12.2.0.1.0" }, { "fixed": "12.2.0.1.19" }, { "introduced": "13.9.4.0.0" }, { "fixed": "13.9.4.2.1" } ], "cpes": [ "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*" ], "vendor_product": "oracle:global_lifecycle_management_opatch", "source": "CPE_RANGE" }, { "extracted_events": [ { "fixed": "19.1.0.0.1" } ], "cpes": [ "cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*" ], "vendor_product": "oracle:goldengate_stream_analytics", "source": "CPE_RANGE" }, { "extracted_events": [ { "introduced": "17.7" }, { "last_affected": "17.12" } ], "cpes": [ "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*" ], "vendor_product": "oracle:primavera_gateway", "source": "CPE_RANGE" }, { "extracted_events": [ { "last_affected": "19.8" } ], "cpes": [ "cpe:2.3:a:oracle:siebel_engineering_-_installer_\\&_deployment:*:*:*:*:*:*:*:*" ], "vendor_product": "oracle:siebel_engineering_-_installer_&_deployment", "source": "CPE_RANGE" }, { "extracted_events": [ { "last_affected": "19.10" } ], "cpes": [ "cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*" ], "vendor_product": "oracle:siebel_ui_framework", "source": "CPE_RANGE" }, { "extracted_events": [ { "last_affected": "1.16.0" } ], "cpes": [ "cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:*" ], "vendor_product": "apache:drill", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "8.0" }, { "last_affected": "9.0" }, { "last_affected": "10.0" } ], "cpes": [ "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "vendor_product": "debian:debian_linux", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "29" }, { "last_affected": "30" } ], "cpes": [ "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*" ], "vendor_product": "fedoraproject:fedora", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "2.4.0" }, { "last_affected": "2.4.1" }, { "last_affected": "2.5.0" }, { "last_affected": "2.6.0" }, { "last_affected": "2.6.1" }, { "last_affected": "2.7.0" }, { "last_affected": "2.7.1" } ], "cpes": [ "cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*" ], "vendor_product": "oracle:banking_platform", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "8.0.0" }, { "last_affected": "8.1" }, { "last_affected": "8.2" }, { "last_affected": "8.2.1" } ], "cpes": [ "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*" ], "vendor_product": "oracle:communications_diameter_signaling_router", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "10.0.1.3.0" } ], "cpes": [ "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.3.0:*:*:*:*:*:*:*" ], "vendor_product": "oracle:communications_instant_messaging_server", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "11.2.0.3.23" }, { "last_affected": "13.9.4.2.1" } ], "cpes": [ "cpe:2.3:a:oracle:global_lifecycle_management_opatch:11.2.0.3.23:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:global_lifecycle_management_opatch:13.9.4.2.1:*:*:*:*:*:*:*" ], "vendor_product": "oracle:global_lifecycle_management_opatch", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "9.2" } ], "cpes": [ "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*" ], "vendor_product": "oracle:jd_edwards_enterpriseone_orchestrator", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "9.2" } ], "cpes": [ "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*" ], "vendor_product": "oracle:jd_edwards_enterpriseone_tools", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "15.2" }, { "last_affected": "16.1" }, { "last_affected": "16.2" }, { "last_affected": "18.8.0" } ], "cpes": [ "cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_gateway:18.8.0:*:*:*:*:*:*:*" ], "vendor_product": "oracle:primavera_gateway", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "17.0" } ], "cpes": [ "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*" ], "vendor_product": "oracle:retail_customer_management_and_segmentation_foundation", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "7.1" }, { "last_affected": "15.0" }, { "last_affected": "16.0" }, { "last_affected": "17.0" }, { "last_affected": "18.0" } ], "cpes": [ "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*" ], "vendor_product": "oracle:retail_xstore_point_of_service", "source": "CPE_STRING" }, { "extracted_events": [ { "last_affected": "1.0" } ], "cpes": [ "cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*" ], "vendor_product": "redhat:jboss_middleware_text-only_advisories", "source": "CPE_STRING" } ] }- References
-
- https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/
- https://access.redhat.com/errata/RHSA-2019:3200
- https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html
- https://seclists.org/bugtraq/2019/Oct/6
- https://security.netapp.com/advisory/ntap-20190814-0001/
- https://www.debian.org/security/2019/dsa-4542
- https://github.com/FasterXML/jackson-databind/issues/2389
- https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b
- https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Affected packages
Git / github.com/fasterxml/jackson-databind
Affected ranges
- Type
- GIT
- Repo
- https://github.com/fasterxml/jackson-databind
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
{ "extracted_events": [ { "introduced": "2.0.0" }, { "fixed": "2.6.7.3" }, { "introduced": "2.7.0" }, { "fixed": "2.7.9.6" }, { "introduced": "2.8.0" }, { "fixed": "2.8.11.4" }, { "introduced": "2.9.0" }, { "fixed": "2.9.9.2" } ], "cpe": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.2.0
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.6.2
jackson-databind-2.6.3
jackson-databind-2.6.4
jackson-databind-2.6.5
jackson-databind-2.6.6
jackson-databind-2.6.7
jackson-databind-2.6.7.1
jackson-databind-2.6.7.2
jackson-databind-2.7.0
jackson-databind-2.7.1
jackson-databind-2.7.1-1
jackson-databind-2.7.2
jackson-databind-2.7.3
jackson-databind-2.7.4
jackson-databind-2.7.5
jackson-databind-2.7.6
jackson-databind-2.7.7
jackson-databind-2.7.8
jackson-databind-2.7.9
jackson-databind-2.7.9.1
jackson-databind-2.7.9.2
jackson-databind-2.7.9.3
jackson-databind-2.7.9.4
jackson-databind-2.7.9.5
jackson-databind-2.8.0
jackson-databind-2.8.1
jackson-databind-2.8.10
jackson-databind-2.8.11
jackson-databind-2.8.11.1
jackson-databind-2.8.11.2
jackson-databind-2.8.11.3
jackson-databind-2.8.2
jackson-databind-2.8.3
jackson-databind-2.8.4
jackson-databind-2.8.5
jackson-databind-2.8.6
jackson-databind-2.8.7
jackson-databind-2.8.8
jackson-databind-2.8.8.1
jackson-databind-2.8.9
jackson-databind-2.9.0
jackson-databind-2.9.1
jackson-databind-2.9.3
jackson-databind-2.9.4
jackson-databind-2.9.5
jackson-databind-2.9.6
jackson-databind-2.9.7
jackson-databind-2.9.8
jackson-databind-2.9.9
jackson-databind-2.9.9.1
Database specific
vanir_signatures
[
{
"digest": {
"line_hashes": [
"185019317653556488357629726211452431623",
"238855854932822636226904752200519445809",
"279302873038015102418510393666390043054"
],
"threshold": 0.9
},
"id": "CVE-2019-14439-4dee2574",
"signature_version": "v1",
"target": {
"file": "src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/fasterxml/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b"
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-14439.json"
vanir_signatures_modified
"2026-06-11T14:08:25Z"