EXPOSURES › CVE-2019-16943
CVE-2019-16943
CRITICAL
DETAIL
SourceNVD · cve
Published2019-10-01
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-16943 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendordebian · vendorfasterxml · vendorfedoraproject · vendorredhat · vendorWebLogic Server · productactive iq unified manager · productbanking platform · productcommunications billing and revenue management · productcommunications calendar server · productcommunications cloud native core network slice selection function · productcommunications evolved communications application server · productdebian linux · productenterprise linux server · productfedora · productglobal lifecycle management nextgen oui framework · productgoldengate application adapters · productjackson-databind · productjboss enterprise application platform · productjd edwards enterpriseone orchestrator · productjd edwards enterpriseone tools · productoncommand api services · productoncommand workflow automation · productprimavera gateway · productretail merchandising system · productretail sales audit · productservice level manager · productsiebel engineering - installer \& deployment · productsteelstore cloud integrated storage · producttrace file analyzer · productwebcenter portal · productwebcenter sites · product
DESCRIPTION
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No security press or authority coverage found in provided sources; only NVD technical description and a failed DuckDuckGo bridge query.
Neutral technical description; no sentiment toward vendor.
"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10."
No coverage; only a connection error.
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |