FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified…
Priority MEDIUM 55CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 20 fixed, 8 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10599 95th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.8, 2.8.11.3, 2.7.9.5Red Hat: 16 advisoriesRed Hat: 20 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.8 | 2.9.8 | Patch available | GHSA-f9hv-mg5h-xcw9 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.8.0 to before 2.8.11.3 | 2.8.11.3 | Patch available | GHSA-f9hv-mg5h-xcw9 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.7.0 to before 2.7.9.5 | 2.7.9.5 | Patch available | GHSA-f9hv-mg5h-xcw9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.8 Fixed in 2.9.8 Patch available GHSA-f9hv-mg5h-xcw9
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11.3 Fixed in 2.8.11.3 Patch available GHSA-f9hv-mg5h-xcw9
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.7.9.5 Fixed in 2.7.9.5 Patch available GHSA-f9hv-mg5h-xcw9
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.6.0 – 2.6.7.2; 2.7.0 to before 2.7.9.5; 2.8.0 to before 2.8.11.3; 2.9.0 to before 2.9.8 | Vulnerable | FasterXML |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.6.0 – 2.6.7.2; 2.7.0 to before 2.7.9.5; 2.8.0 to before 2.8.11.3; 2.9.0 to before 2.9.8 Vulnerable ·FasterXML
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9.0.0:*:*:*:*:*:*:* | 1.60.9.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:* | 7.3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:* | 7.3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_bpm_suite:6.4.11:*:*:*:*:*:*:* | 6.4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:* | 6.4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9.0.0:*:*:*:*:*:*:* Versions 1.60.9.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_bpm_suite:6.4.11:*:*:*:*:*:*:* Versions 6.4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:* Versions 6.4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-f9hv-mg5h-xcw9 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.8 Advisory →
- Fix · GHSA-f9hv-mg5h-xcw9 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.3 Advisory →
- Fix · GHSA-f9hv-mg5h-xcw9 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.5 Advisory →
Red Hat 16 advisories
- RHSA-2021:1515 Released 2021-05-06 · Red Hat rating ImportantOpenshift Logging Bug Fix Release (5.0.3)
- OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
- RHSA-2021:1230 Released 2021-04-27 · Red Hat rating ImportantOpenShift Container Platform 4.6.26 security and extras update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6
- RHSA-2020:2564 Released 2020-06-15 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 16 security update
- Red Hat JBoss Enterprise Application Platform Continuous Delivery
Show 13 more Red Hat advisories
- RHSA-2019:4037 Released 2019-12-02 · Red Hat rating ImportantRed Hat Data Grid 7.3.2 security update
- Red Hat Data Grid
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
- RHSA-2019:3140 Released 2019-10-17 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.4.8 security update
- Red Hat JBoss Data Virtualization 6.4.8
- RHSA-2019:3002 Released 2019-10-10 · Red Hat rating ImportantRed Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
- RHSA-2019:2804 Released 2019-09-17 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R13 security and bug fix update
- Red Hat Fuse 6.3
- RHSA-2019:1822 Released 2019-07-22 · Red Hat rating ImportantRed Hat Decision Manager 7.4.0 Security Update
- Red Hat JBoss BRMS 7.4
- RHSA-2019:1823 Released 2019-07-22 · Red Hat rating ImportantRed Hat Process Automation Manager 7.4.0 Security Update
- Red Hat JBoss BPMS 7.4
- RHSA-2019:1797 Released 2019-07-16 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.4.12 security update
- Red Hat JBoss BPMS 6.4
- RHSA-2019:1782 Released 2019-07-15 · Red Hat rating ImportantRed Hat JBoss BRMS 6.4.12 security update
- Red Hat JBoss BRMS 6.4.12
- RHSA-2019:0877 Released 2019-04-24 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2019:0782 Released 2019-04-17 · Red Hat rating Importantrh-maven35-jackson-databind security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix yet |
| OpenShift Logging 5.0 | Fixed | RHSA-2021:1515 |
| Red Hat Data Grid | Fixed | RHSA-2019:4037 |
| Red Hat Fuse 6.3 | Fixed | RHSA-2019:2804 |
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13 | Fixed | RHSA-2019:3002 |
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2019:1797 |
| Red Hat JBoss BPMS 7.4 | Fixed | RHSA-2019:1823 |
| Red Hat JBoss BRMS 6.4.12 | Fixed | RHSA-2019:1782 |
| Red Hat JBoss BRMS 7.4 | Fixed | RHSA-2019:1822 |
| Red Hat JBoss Data Virtualization 6.4.8 | Fixed | RHSA-2019:3140 |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | Fixed | RHSA-2020:2564 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:1230 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:0782 |
| Text-Only RHOAR | Fixed | RHSA-2019:0877 |
Not affected: 15 products
- OpenShift Logging 5.0
- Red Hat Enterprise Linux 8
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
- Red Hat Mobile Application Platform 4
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.6
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 14 (Rocky)
- Red Hat OpenStack Platform 8 (Liberty)
- Red Hat OpenStack Platform 9 (Mitaka)
- Red Hat Satellite 6
- Red Hat Subscription Asset Manager
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-19360
- 2026-10-03 Alias added: GHSA-f9hv-mg5h-xcw9
- 2026-10-16 CISA SSVC decision points changed
References
Patch 5
- https://github.com/FasterXML/jackson-databind/issues/2186
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Advisory 21
- [debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- RHSA-2019:0782
- RHSA-2019:0877
- RHBA-2019:0959
- DSA-4452
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update
- https://security.netapp.com/advisory/ntap-20190530-0003/
- RHSA-2019:1782
- RHSA-2019:1797
- RHSA-2019:1822
- RHSA-2019:1823
- RHSA-2019:2804
- RHSA-2019:2858
- RHSA-2019:3002
- RHSA-2019:3140
- RHSA-2019:3149
- RHSA-2019:3892
- RHSA-2019:4037
- https://nvd.nist.gov/vuln/detail/CVE-2018-19360
- https://github.com/advisories/GHSA-f9hv-mg5h-xcw9
Other 23
- [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities
- [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190530-0003
- https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E
Sources
- CVE-2018-19360 · CVE Program
- CVE-2018-19360 · NVD
- FIRST EPSS
- GHSA-f9hv-mg5h-xcw9 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-19360 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences