CVE-2019-14379

EPSS 8.11%
Veröffentlicht 29.07.2019 12:15:16
Zuletzt bearbeitet 21.11.2024 04:26:37
Erkennungen
Login

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 62

NVD 58 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Fasterxml ≫ Jackson-databind Version >= 2.0.0 < 2.6.7.3

Fasterxml ≫ Jackson-databind Version >= 2.7.0 < 2.7.9.6

Fasterxml ≫ Jackson-databind Version >= 2.8.0 < 2.8.11.4

Fasterxml ≫ Jackson-databind Version >= 2.9.0 < 2.9.9.2

Debian ≫ Debian Linux Version 8.0

Netapp ≫ Active Iq Unified Manager SwPlatform linux Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatform windows Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatform vmware_vsphere Version >= 9.5

Netapp ≫ Oncommand Workflow Automation Version -

Netapp ≫ Service Level Manager Version -

Netapp ≫ Snapcenter Version -

Fedoraproject ≫ Fedora Version 29

Fedoraproject ≫ Fedora Version 30

Fedoraproject ≫ Fedora Version 31

Redhat ≫ Jboss Enterprise Application Platform Version 7.2

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.3

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Openshift Container Platform Version 4.1

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Single Sign-on Version 7.3

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Openshift Container Platform Version 3.11

Redhat ≫ Jboss Enterprise Application Platform Version 7.2

Redhat ≫ Enterprise Linux Version 6.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.3

Redhat ≫ Enterprise Linux Version 6.0

Redhat ≫ Single Sign-on Version 7.3

Redhat ≫ Enterprise Linux Version 6.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.2

Redhat ≫ Enterprise Linux Version 8.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.3

Redhat ≫ Enterprise Linux Version 8.0

Redhat ≫ Single Sign-on Version 7.3

Redhat ≫ Enterprise Linux Version 8.0

Oracle ≫ Banking Platform Version 2.4.0

Oracle ≫ Banking Platform Version 2.4.1

Oracle ≫ Banking Platform Version 2.5.0

Oracle ≫ Banking Platform Version 2.6.0

Oracle ≫ Banking Platform Version 2.6.1

Oracle ≫ Banking Platform Version 2.7.0

Oracle ≫ Banking Platform Version 2.7.1

Oracle ≫ Communications Diameter Signaling Router Version 8.0.0

Oracle ≫ Communications Diameter Signaling Router Version 8.1

Oracle ≫ Communications Diameter Signaling Router Version 8.2

Oracle ≫ Communications Diameter Signaling Router Version 8.2.1

Oracle ≫ Communications Instant Messaging Server Version 10.0.1.3.0

Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 8.0.2 <= 8.0.8

Oracle ≫ Goldengate Stream Analytics Version < 19.1.0.0.1

Oracle ≫ Jd Edwards Enterpriseone Orchestrator Version 9.2

Oracle ≫ Jd Edwards Enterpriseone Tools Version 9.2

Oracle ≫ Primavera Gateway Version 15.2

Oracle ≫ Primavera Gateway Version 16.2

Oracle ≫ Primavera Gateway Version 17.12

Oracle ≫ Primavera Gateway Version 18.8.0

Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12

Oracle ≫ Primavera Unifier Version 16.1

Oracle ≫ Primavera Unifier Version 16.2

Oracle ≫ Primavera Unifier Version 18.8

Oracle ≫ Retail Customer Management And Segmentation Foundation Version 17.0

Oracle ≫ Retail Xstore Point Of Service Version 7.1

Oracle ≫ Retail Xstore Point Of Service Version 15.0

Oracle ≫ Retail Xstore Point Of Service Version 16.0

Oracle ≫ Retail Xstore Point Of Service Version 17.0

Oracle ≫ Retail Xstore Point Of Service Version 18.0

Oracle ≫ Siebel Engineering - Installer & Deployment Version <= 19.8

Oracle ≫ Siebel Ui Framework Version <= 19.10

Apple ≫ XCode Version < 13.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	8.11%	0.942

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

https://www.oracle.com/security-alerts/cpujan2020.html

Third Party Advisory

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

https://www.oracle.com/security-alerts/cpuapr2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Patch

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E

https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E

https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:2858

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0727

Third Party Advisory

https://access.redhat.com/errata/RHBA-2019:2824

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2998

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2935

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2936

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2937

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2938

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3044

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3045

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3046

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3050

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3200

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/

https://access.redhat.com/errata/RHSA-2019:3292

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3297

Third Party Advisory

https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E

https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E

https://access.redhat.com/errata/RHSA-2019:3901

Third Party Advisory

http://seclists.org/fulldisclosure/2022/Mar/23

Third Party Advisory

Mailing List

https://access.redhat.com/errata/RHSA-2019:2743

Third Party Advisory

https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2

Patch

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/2387

Patch

Third Party Advisory

Issue Tracking

https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E

https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb%40%3Ccommits.pulsar.apache.org%3E

https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d%40%3Cissues.iceberg.apache.org%3E

https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E

https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a%40%3Ccommits.ambari.apache.org%3E

https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20190814-0001/

Third Party Advisory

https://support.apple.com/kb/HT213189

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-14379

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-14379

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-14379

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2019-14379