SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
AND |
|
Configuration 9 (hide)
|
Configuration 10 (hide)
|
History
No history.
Information
Published : 2019-07-29 12:15
Updated : 2023-11-07 03:04
NVD link : CVE-2019-14379
Mitre link : CVE-2019-14379
CVE.ORG link : CVE-2019-14379
JSON object : View
Products Affected
redhat
- jboss_enterprise_application_platform
- single_sign-on
- enterprise_linux
- openshift_container_platform
oracle
- primavera_unifier
- siebel_ui_framework
- retail_xstore_point_of_service
- financial_services_analytical_applications_infrastructure
- jd_edwards_enterpriseone_tools
- retail_customer_management_and_segmentation_foundation
- banking_platform
- jd_edwards_enterpriseone_orchestrator
- communications_diameter_signaling_router
- primavera_gateway
- communications_instant_messaging_server
- siebel_engineering_-_installer_\&_deployment
- goldengate_stream_analytics
debian
- debian_linux
apple
- xcode
fedoraproject
- fedora
netapp
- service_level_manager
- active_iq_unified_manager
- snapcenter
- oncommand_workflow_automation
fasterxml
- jackson-databind
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')