CVE-2019-16335GHSA-85CW-HJ65-QQV9
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.9.10, 2.8.11.5, 2.6.7.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- com.fasterxml.jackson.core:jackson-databindMaven
From 2.9.0 · fixed in 2.9.10
- com.fasterxml.jackson.core:jackson-databindMaven
From 2.7.0 · fixed in 2.8.11.5
- com.fasterxml.jackson.core:jackson-databindMaven
fixed in 2.6.7.3
References 25
lists.apache.org
- thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@<commits.tinkerpop.apache.org>
- thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@<issues.hbase.apache.org>
- thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@<issues.hbase.apache.org>
- thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@<issues.hbase.apache.org>
- thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@<issues.hbase.apache.org>
- thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@<commits.hbase.apache.org>
- thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@<dev.drill.apache.org>
- thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@<dev.drill.apache.org>
- thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@<issues.drill.apache.org>
- thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@<commits.nifi.apache.org>
- thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@<commits.nifi.apache.org>