CVE-2019-14893

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200 CWE-502

Affected software

Vendor	Product	Versions
Red Hat	jackson-databind	2.9.10; 2.10.0

References

https://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893Issue Tracking, Patch, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2469Third Party Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://security.netapp.com/advisory/ntap-20200327-0006/Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893Issue Tracking, Patch, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2469Third Party Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://security.netapp.com/advisory/ntap-20200327-0006/Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory

Timeline

Published: Mar 2, 2020
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148947.2A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execut CVE-2019-148959.8A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. Th CVE-2019-148969.8A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attac CVE-2019-148979.8A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to caus CVE-2019-148987.0The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive CVE-2019-148997.4A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user CVE-2019-14905.4A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Busi CVE-2019-149006.5A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criter CVE-2019-149019.8A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerabili CVE-2019-149025.4There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4 CVE-2019-149047.3A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the CVE-2019-149055.6A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansib