CVE-2019-14892

7.5HIGH

Key Information:

Vendor
Red Hat
Status
Jackson-databind
Vendor
CVE Published:
2 March 2020

Summary

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Affected Version(s)

jackson-databind Versions before 2.9.10

jackson-databind Versions before 2.8.11.5

jackson-databind Versions before 2.6.7.3

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892
x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/issues/2462
x_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0729
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.