CVE-2019-14540
Critical
Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fasterxml Jackson-databind
PublishedSep 15, 2019
First seenSep 15, 2019
How to fix
Update
- fasterxml jackson-databind2.6.7.3, 2.8.11.5, 2.9.10 or later
- oracle global_lifecycle_management_opatch11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1 or later
- oracle goldengate_stream_analytics19.1.0.0.1 or later
- com.fasterxml.jackson.core:jackson-databind2.9.10, 2.8.11.5, 2.6.7.3 or later
Vendor advisories
- debian.org/security/2019/dsa-4542
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
- access.redhat.com/errata/RHSA-2019:3200
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
- access.redhat.com/errata/RHSA-2020:0164
- access.redhat.com/errata/RHSA-2020:0159
- access.redhat.com/errata/RHSA-2020:0160
- access.redhat.com/errata/RHSA-2020:0161
- access.redhat.com/errata/RHSA-2020:0445
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fasterxml jackson-databind | 2.0.0 ≤ v < 2.6.7.3, 2.7.0 ≤ v < 2.8.11.5, 2.9.0 ≤ v < 2.9.10 | 2.6.7.3, 2.8.11.5, 2.9.10 |
| netapp oncommand_api_services | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| fedoraproject fedora | 30, 31 | — |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| redhat jboss_enterprise_application_platform | 7.2, 7.3 | — |
| oracle banking_platform | 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.7.1 | — |
| oracle customer_management_and_segmentation_foundation | 18.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.2 ≤ v ≤ 8.0.8 | — |
| oracle global_lifecycle_management_opatch | v < 11.2.0.3.23, 12.2.0.1.0 ≤ v < 12.2.0.1.19, 13.9.4.0.0 ≤ v < 13.9.4.2.1 | 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1 |
| oracle goldengate_application_adapters | 19.1.0.0.0 | — |
| oracle goldengate_stream_analytics | v < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle mysql | 5.7.0 ≤ v ≤ 5.7.30, 8.0.0 ≤ v ≤ 8.0.20 | — |
| oracle primavera_gateway | 15.2, 15.2.18, 16.2, 16.2.11, 17.12, 17.12.6, 18.8.0, 18.8.8.1 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 16.1, 16.2, 18.8, 19.12 | — |
| oracle retail_customer_management_and_segmentation_foundation | 17.0 | — |
| oracle retail_xstore_point_of_service | 7.1, 15.0, 16.0, 17.0, 18.0 | — |
| oracle weblogic_server | 12.2.1.3.0 | — |
| com.fasterxml.jackson.core:jackson-databindMaven | 2.9.0 ≤ v < 2.9.10, 2.7.0 ≤ v < 2.8.11.5, v < 2.6.7.3 | 2.9.10, 2.8.11.5, 2.6.7.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.