Read the docs
TI-2019-11097 Aliases CVE-2019-14893GHSA-qmqc-x3r4-6v39

Information disclosure in Red Hat jackson-databind

Priority MEDIUM 56CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 14 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-502.

Summary

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04091 90th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10Red Hat: 11 advisoriesRed Hat: 11 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatjackson-databind2.9.10; 2.10.0—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.9.0 to before 2.9.102.9.10Patch availableGHSA-qmqc-x3r4-6v39
  • jackson-databind VendorRed Hat Affected 2.9.10; 2.10.0 Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.10 Fixed in 2.9.10 Patch available GHSA-qmqc-x3r4-6v39

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.8.0 to before 2.8.11.5; 2.9.0 to before 2.9.10VulnerableFasterXML
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*before 19.1.0.0.1VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.8.0 to before 2.8.11.5; 2.9.0 to before 2.9.10 Vulnerable ·FasterXML
  • cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:* Versions before 19.1.0.0.1 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-qmqc-x3r4-6v39 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10 Advisory →

Red Hat 11 advisories

  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0
  • RHSA-2020:2333 Released 2020-05-28 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 19 security update
    • EAP-CD 19 Tech Preview
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
Show 8 more Red Hat advisories
  • RHSA-2020:0899 Released 2020-03-18 · Red Hat rating Important
    Red Hat Decision Manager 7.7.0 Security Update
    • Red Hat Decision Manager 7
  • RHSA-2020:0895 Released 2020-03-18 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.7.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2020:0729 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.5 security update
    • Red Hat Data Grid 7.3.5
  • RHSA-2020:0445 Released 2020-02-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.6 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2020:0160 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el7eap +47
  • RHSA-2020:0161 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el8eap +47
  • RHSA-2020:0159 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el6eap +47
  • RHSA-2020:0164 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 security update
    • Red Hat JBoss EAP 7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Mobile Application Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.10AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
EAP-CD 19 Tech PreviewFixed RHSA-2020:2333
Red Hat Data Grid 7.3.5Fixed RHSA-2020:0729
Red Hat Decision Manager 7Fixed RHSA-2020:0899
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192
Red Hat JBoss EAP 7.2Fixed RHSA-2020:0164
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:0159
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:0160
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:0161
Red Hat Process Automation 7Fixed RHSA-2020:0895
Red Hat Single Sign-On 7.3Fixed RHSA-2020:0445
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat Satellite 6
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14893
  2. 2026-10-03 Alias added: GHSA-qmqc-x3r4-6v39
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 1

Advisory 6

Other 6

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences