FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified…
Priority MEDIUM 55CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 20 fixed, 13 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10599 95th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.7.9.5, 2.9.8, 2.8.11.3Red Hat: 16 advisoriesRed Hat: 20 fixed, 13 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.7.0 to before 2.7.9.5 | 2.7.9.5 | Patch available | GHSA-mx9v-gmh4-mgqw |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.8 | 2.9.8 | Patch available | GHSA-mx9v-gmh4-mgqw |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.8.0 to before 2.8.11.3 | 2.8.11.3 | Patch available | GHSA-mx9v-gmh4-mgqw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.7.9.5 Fixed in 2.7.9.5 Patch available GHSA-mx9v-gmh4-mgqw
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.8 Fixed in 2.9.8 Patch available GHSA-mx9v-gmh4-mgqw
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11.3 Fixed in 2.8.11.3 Patch available GHSA-mx9v-gmh4-mgqw
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.6.0 – 2.6.7.2; 2.7.0 to before 2.7.9.5; 2.8.0 to before 2.8.11.3; 2.9.0 to before 2.9.8 | Vulnerable | FasterXML |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Oracle |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.6.0 – 2.6.7.2; 2.7.0 to before 2.7.9.5; 2.8.0 to before 2.8.11.3; 2.9.0 to before 2.9.8 Vulnerable ·FasterXML
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9.0.0:*:*:*:*:*:*:* | 1.60.9.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:* | 7.3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:* | 7.3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_bpm_suite:6.4.11:*:*:*:*:*:*:* | 6.4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:* | 6.4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9.0.0:*:*:*:*:*:*:* Versions 1.60.9.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:redhat:automation_manager:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:decision_manager:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_bpm_suite:6.4.11:*:*:*:*:*:*:* Versions 6.4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_brms:6.4.10:*:*:*:*:*:*:* Versions 6.4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-mx9v-gmh4-mgqw com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.5 Advisory →
- Fix · GHSA-mx9v-gmh4-mgqw com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.8 Advisory →
- Fix · GHSA-mx9v-gmh4-mgqw com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.3 Advisory →
Red Hat 16 advisories
- RHSA-2021:1515 Released 2021-05-06 · Red Hat rating ImportantOpenshift Logging Bug Fix Release (5.0.3)
- OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8, openshift-logging/eventrouter-rhel8
- RHSA-2021:1230 Released 2021-04-27 · Red Hat rating ImportantOpenShift Container Platform 4.6.26 security and extras update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-elasticsearch6
- RHSA-2020:2564 Released 2020-06-15 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 16 security update
- Red Hat JBoss Enterprise Application Platform Continuous Delivery
Show 13 more Red Hat advisories
- RHSA-2019:4037 Released 2019-12-02 · Red Hat rating ImportantRed Hat Data Grid 7.3.2 security update
- Red Hat Data Grid
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
- RHSA-2019:3149 Released 2019-10-18 · Red Hat rating ImportantOpenShift Container Platform logging-elasticsearch5-container security update
- Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
- RHSA-2019:3140 Released 2019-10-17 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.4.8 security update
- Red Hat JBoss Data Virtualization 6.4.8
- RHSA-2019:3002 Released 2019-10-10 · Red Hat rating ImportantRed Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update
- Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13
- RHSA-2019:2858 Released 2019-09-27 · Red Hat rating ImportantOpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
- Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
- RHSA-2019:2804 Released 2019-09-17 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R13 security and bug fix update
- Red Hat Fuse 6.3
- RHSA-2019:1822 Released 2019-07-22 · Red Hat rating ImportantRed Hat Decision Manager 7.4.0 Security Update
- Red Hat JBoss BRMS 7.4
- RHSA-2019:1823 Released 2019-07-22 · Red Hat rating ImportantRed Hat Process Automation Manager 7.4.0 Security Update
- Red Hat JBoss BPMS 7.4
- RHSA-2019:1797 Released 2019-07-16 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.4.12 security update
- Red Hat JBoss BPMS 6.4
- RHSA-2019:1782 Released 2019-07-15 · Red Hat rating ImportantRed Hat JBoss BRMS 6.4.12 security update
- Red Hat JBoss BRMS 6.4.12
- RHSA-2019:0877 Released 2019-04-24 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2019:0782 Released 2019-04-17 · Red Hat rating Importantrh-maven35-jackson-databind security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.5.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.5.el7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.6 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix yet |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Out of support scope |
| OpenShift Logging 5.0 | Fixed | RHSA-2021:1515 |
| Red Hat Data Grid | Fixed | RHSA-2019:4037 |
| Red Hat Fuse 6.3 | Fixed | RHSA-2019:2804 |
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
| Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R13 | Fixed | RHSA-2019:3002 |
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2019:1797 |
| Red Hat JBoss BPMS 7.4 | Fixed | RHSA-2019:1823 |
| Red Hat JBoss BRMS 6.4.12 | Fixed | RHSA-2019:1782 |
| Red Hat JBoss BRMS 7.4 | Fixed | RHSA-2019:1822 |
| Red Hat JBoss Data Virtualization 6.4.8 | Fixed | RHSA-2019:3140 |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | Fixed | RHSA-2020:2564 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2019:3149 |
| Red Hat OpenShift Container Platform 4.1 | Fixed | RHSA-2019:2858 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:1230 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:0782 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:0782 |
| Text-Only RHOAR | Fixed | RHSA-2019:0877 |
Not affected: 10 products
- OpenShift Logging 5.0
- Red Hat Enterprise Linux 8
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
- Red Hat Mobile Application Platform 4
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.6
- Red Hat Satellite 6
- Red Hat Subscription Asset Manager
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-19361
- 2026-10-03 Alias added: GHSA-mx9v-gmh4-mgqw
- 2026-10-16 CISA SSVC decision points changed
References
Patch 5
- https://github.com/FasterXML/jackson-databind/issues/2186
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Advisory 21
- [debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- RHSA-2019:0782
- RHSA-2019:0877
- RHBA-2019:0959
- DSA-4452
- 20190527 [SECURITY] [DSA 4452-1] jackson-databind security update
- https://security.netapp.com/advisory/ntap-20190530-0003/
- RHSA-2019:1782
- RHSA-2019:1797
- RHSA-2019:1822
- RHSA-2019:1823
- RHSA-2019:2804
- RHSA-2019:2858
- RHSA-2019:3002
- RHSA-2019:3140
- RHSA-2019:3149
- RHSA-2019:3892
- RHSA-2019:4037
- https://nvd.nist.gov/vuln/detail/CVE-2018-19361
- https://github.com/advisories/GHSA-mx9v-gmh4-mgqw
Other 23
- [infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities
- [pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190530-0003
- https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E
Sources
- CVE-2018-19361 · CVE Program
- CVE-2018-19361 · NVD
- FIRST EPSS
- GHSA-mx9v-gmh4-mgqw · GitHub Advisory Database · CC BY 4.0
- CVE-2018-19361 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences