Read the docs
TI-2019-12635 Aliases CVE-2019-16943GHSA-fmmc-742q-jg75

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through…

Priority MEDIUM 56CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 14 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04741 91st percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10.1, 2.8.11.5, 2.6.7.3Red Hat: 14 advisoriesRed Hat: 14 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.9.0 to before 2.9.10.12.9.10.1Patch availableGHSA-fmmc-742q-jg75
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0 to before 2.8.11.52.8.11.5Patch availableGHSA-fmmc-742q-jg75
—com.fasterxml.jackson.core:jackson-databind (Maven)before 2.6.7.32.6.7.3Patch availableGHSA-fmmc-742q-jg75
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.10.1 Fixed in 2.9.10.1 Patch available GHSA-fmmc-742q-jg75
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.8.11.5 Fixed in 2.8.11.5 Patch available GHSA-fmmc-742q-jg75
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.6.7.3 Fixed in 2.6.7.3 Patch available GHSA-fmmc-742q-jg75

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.0.0 to before 2.6.7.3; 2.7.0 to before 2.8.11.5; 2.9.0 to before 2.9.10.1VulnerableFasterXML
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.3; 2.7.0 to before 2.8.11.5; 2.9.0 to before 2.9.10.1 Vulnerable ·FasterXML
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*2.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*7.5.0.23.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*8.0.0.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:*8.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*13.9.4.2.2VulnerableOracle
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*19.1.0.0.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.7 – 17.12.6; 18.8.0 – 18.8.8VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*19.12.0VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*16.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*up to 2.20.5VulnerableOracle
cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:*19cVulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*7.3VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*7.3VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*9.5VulnerableNetApp
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:o:redhat:enterprise_linux_server:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* Versions 7.5.0.23.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:* Versions 8.0.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:* Versions 8.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:* Versions 13.9.4.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* Versions 19.1.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.7 – 17.12.6; 18.8.0 – 18.8.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:* Versions 19.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:* Versions 16.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:* Versions up to 2.20.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* Versions 7.3 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-fmmc-742q-jg75 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10.1 Advisory →
  • Fix · GHSA-fmmc-742q-jg75 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.5 Advisory →
  • Fix · GHSA-fmmc-742q-jg75 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.3 Advisory →

Red Hat 14 advisories

  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0
  • RHSA-2020:2333 Released 2020-05-28 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 19 security update
    • EAP-CD 19 Tech Preview
  • RHSA-2020:2321 Released 2020-05-26 · Red Hat rating Important
    Red Hat Data Grid 7.3.6 security update
    • Red Hat Data Grid 7.3.6
Show 11 more Red Hat advisories
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:1644 Released 2020-04-28 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2020:0939 Released 2020-03-23 · Red Hat rating Important
    Red Hat AMQ Streams 1.4.0 release and security update
    • Red Hat AMQ Streams 1
  • RHSA-2020:0899 Released 2020-03-18 · Red Hat rating Important
    Red Hat Decision Manager 7.7.0 Security Update
    • Red Hat Decision Manager 7
  • RHSA-2020:0895 Released 2020-03-18 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.7.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2020:0445 Released 2020-02-06 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.6 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2020:0160 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el7eap +47
  • RHSA-2020:0161 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el8eap +47
  • RHSA-2020:0159 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el6eap +47
  • RHSA-2020:0164 Released 2020-01-21 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.6 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:3901 Released 2019-11-18 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Vert.x 3.8.3 security update
    • Red Hat Openshift Application Runtimes Vert.x 3.8.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Mobile Application Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.10AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
EAP-CD 19 Tech PreviewFixed RHSA-2020:2333
Red Hat AMQ Streams 1Fixed RHSA-2020:0939
Red Hat Data Grid 7.3.6Fixed RHSA-2020:2321
Red Hat Decision Manager 7Fixed RHSA-2020:0899
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:1644
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192
Red Hat JBoss EAP 7.2Fixed RHSA-2020:0164
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:0159
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:0160
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:0161
Red Hat Openshift Application Runtimes Vert.x 3.8.3Fixed RHSA-2019:3901
Red Hat Process Automation 7Fixed RHSA-2020:0895
Red Hat Single Sign-On 7.3Fixed RHSA-2020:0445
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 1 product
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16943
  2. 2026-10-03 Alias added: GHSA-fmmc-742q-jg75
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed

References

Patch 3

Advisory 15

Other 24

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences