Read the docs
TI-2019-11096 Aliases CVE-2019-14892GHSA-cf6r-3wgc-h863

Information disclosure in Red Hat jackson-databind

Priority MEDIUM 57CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 15 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-502.

Summary

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05576 92nd percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.6.7.3, 2.8.11.5, 2.9.10Red Hat: 11 advisoriesRed Hat: 11 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatjackson-databindbefore 2.9.10; before 2.8.11.5; before 2.6.7.32.9.10, 2.8.11.5, 2.6.7.3Patch availableCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)before 2.6.7.32.6.7.3Patch availableGHSA-cf6r-3wgc-h863
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0 to before 2.8.11.52.8.11.5Patch availableGHSA-cf6r-3wgc-h863
—com.fasterxml.jackson.core:jackson-databind (Maven)2.9.0 to before 2.9.102.9.10Patch availableGHSA-cf6r-3wgc-h863
  • jackson-databind VendorRed Hat Affected before 2.9.10; before 2.8.11.5; before 2.6.7.3 Fixed in 2.9.10, 2.8.11.5, 2.6.7.3 Patch available CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.6.7.3 Fixed in 2.6.7.3 Patch available GHSA-cf6r-3wgc-h863
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.8.11.5 Fixed in 2.8.11.5 Patch available GHSA-cf6r-3wgc-h863
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.10 Fixed in 2.9.10 Patch available GHSA-cf6r-3wgc-h863

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.0.0 to before 2.6.7.3; 2.7.0 to before 2.8.11.5; 2.9.0 to before 2.9.10VulnerableFasterXML
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:*4.3VulnerableRed Hat
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*1.12.0VulnerableApache
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.8.11.5; 2.9.0 to before 2.9.10 Vulnerable ·FasterXML
  • cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-cf6r-3wgc-h863 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.3 Advisory →
  • Fix · GHSA-cf6r-3wgc-h863 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.5 Advisory →
  • Fix · GHSA-cf6r-3wgc-h863 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10 Advisory →

Red Hat 11 advisories

  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0
  • RHSA-2020:2333 Released 2020-05-28 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 19 security update
    • EAP-CD 19 Tech Preview
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
Show 8 more Red Hat advisories
  • RHSA-2020:0899 Released 2020-03-18 · Red Hat rating Important
    Red Hat Decision Manager 7.7.0 Security Update
    • Red Hat Decision Manager 7
  • RHSA-2020:0895 Released 2020-03-18 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.7.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2020:0729 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.5 security update
    • Red Hat Data Grid 7.3.5
  • RHSA-2020:0445 Released 2020-02-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.6 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2020:0160 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el7eap +47
  • RHSA-2020:0161 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el8eap +47
  • RHSA-2020:0159 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el6eap +47
  • RHSA-2020:0164 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 security update
    • Red Hat JBoss EAP 7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Mobile Application Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.10AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix planned: Will not fix
EAP-CD 19 Tech PreviewFixed RHSA-2020:2333
Red Hat Data Grid 7.3.5Fixed RHSA-2020:0729
Red Hat Decision Manager 7Fixed RHSA-2020:0899
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192
Red Hat JBoss EAP 7.2Fixed RHSA-2020:0164
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:0159
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:0160
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:0161
Red Hat Process Automation 7Fixed RHSA-2020:0895
Red Hat Single Sign-On 7.3Fixed RHSA-2020:0445
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14892
  2. 2026-10-03 Alias added: GHSA-cf6r-3wgc-h863
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 1

Advisory 4

Other 8

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2019-11045 Insufficiently protected credentials in Business-central CVSS 3.1HIGH 7.5
  • TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-08616 An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and… CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences