CVE-2019-12384
- State
- Published
- Severity
- Not scored
- Published
- Jun 24, 2019
- Updated
- Oct 8, 2026
- Reserved
- May 27, 2019
Description
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [debian-lts-announce] 20190621 [SECURITY] [DLA 1831-1] jackson-databind security updatemailing-list
- RHSA-2019:1820vendor-advisory
- [tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] robert-schaft-hon commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [tomee-dev] 20190906 [GitHub] [tomee] rzo1 commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [struts-dev] 20190908 Build failed in Jenkins: Struts-master-JDK8-dependency-check #204mailing-list
- [tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- [tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439mailing-list
- RHSA-2019:2720vendor-advisory
- FEDORA-2019-99ff6aa32cvendor-advisory
- [cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to >= 2.9.9.3 to address security vulnerabilitiesmailing-list
- FEDORA-2019-ae6a703b8fvendor-advisory
- FEDORA-2019-fb23eccc03vendor-advisory
- RHSA-2019:2858vendor-advisory
- RHSA-2019:2937vendor-advisory
- RHSA-2019:2935vendor-advisory
- RHSA-2019:2936vendor-advisory
- RHSA-2019:2938vendor-advisory
- DSA-4542vendor-advisory
- 20191007 [SECURITY] [DSA 4542-1] jackson-databind security updatemailing-list
- [geode-notifications] 20191007 [GitHub] [geode] jmelchio commented on issue #4102: Fix for GEODE-7255: Pickup Jackson CVE fixmailing-list
- RHSA-2019:2998vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- RHSA-2019:3149vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- RHSA-2019:3200vendor-advisory
- RHSA-2019:3292vendor-advisory
- RHSA-2019:3297vendor-advisory
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.htmlmailing-list
- RHSA-2019:3901vendor-advisory
- RHSA-2019:4352vendor-advisory
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.htmlmailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://doyensec.com/research.html
- https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad
- https://security.netapp.com/advisory/ntap-20190703-0002/
- https://blog.doyensec.com/2019/07/22/jackson-gadgets.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.