Skip to content
COOEY

EXPOSURES › CVE-2019-14892

CVE-2019-14892

CRITICAL
DETAIL
SourceNVD · cve Published2020-03-02 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-14892 ↗

▸ RECOMMENDED ACTION  Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED
apache · vendorfasterxml · vendorredhat · vendordecision manager · productgeode · productjackson-databind · productjboss data grid · productjboss enterprise application platform · productjboss fuse · productopenshift container platform · productprocess automation · product
DESCRIPTION

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

SENTIMENT · TRUSTED SOURCES
synthesis severe-fallout -0.60
Apache faced severe fallout due to a critical RCE flaw in jackson-databind, widely condemned for allowing arbitrary code execution via polymorphic deserialization.
cooey ↗ severe-fallout -0.80
Severe condemnation for a critical RCE flaw in jackson-databind that allowed arbitrary code execution via polymorphic deserialization.
"A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code."
127.0.0.1 ↗ severe-fallout +0.00
No usable coverage; source returned a connection error and provided no information on the vulnerability or vendor response.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.