CVE-2019-14892
CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Affected Platforms (CPE)
📦
Fasterxml
Jackson Databind
>= 2.0.0 and < 2.6.7.3📦
Fasterxml
Jackson Databind
>= 2.7.0 and < 2.8.11.5📦
Fasterxml
Jackson Databind
>= 2.9.0 and < 2.9.10📦
Redhat
Decision Manager
= 7.0📦
Redhat
Jboss Data Grid
All versions📦
Redhat
Jboss Data Grid
= 7.0.0📦
Redhat
Jboss Enterprise Application Platform
= 7.0📦
Redhat
Jboss Fuse
= 7.0.0📦
Redhat
Openshift Container Platform
= 4.3📦
Redhat
Process Automation
= 7.0📦
Apache