SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CRITICAL 9.8EPSS 8.11%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
8.11% probability · 94th percentile
CISA KEV
Not listed
Weakness
CWE-1321
Affected
fasterxml/jackson-databind · debian/debian linux · netapp/active iq unified manager · netapp/oncommand workflow automation · netapp/service level manager · netapp/snapcenter · fedoraproject/fedora · redhat/jboss enterprise application platform · redhat/openshift container platform · redhat/single sign-on · oracle/banking platform · oracle/communications diameter signaling router · oracle/communications instant messaging server · oracle/financial services analytical applications infrastructure · oracle/goldengate stream analytics · oracle/jd edwards enterpriseone orchestrator · oracle/jd edwards enterpriseone tools · oracle/primavera gateway · oracle/primavera unifier · oracle/retail customer management and segmentation foundation · +4 more
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.