A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10.
Priority MEDIUM 50CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 13 fixed, 14 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04628 91st percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.9.10, 2.8.11.5Red Hat: 13 advisoriesRed Hat: 13 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.9.0 to before 2.9.10 | 2.9.10 | Patch available | GHSA-f3j5-rmmp-3fc5 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | before 2.8.11.5 | 2.8.11.5 | Patch available | GHSA-f3j5-rmmp-3fc5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.10 Fixed in 2.9.10 Patch available GHSA-f3j5-rmmp-3fc5
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.8.11.5 Fixed in 2.8.11.5 Patch available GHSA-f3j5-rmmp-3fc5
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | 2.0.0 to before 2.8.11.5; 2.9.0 to before 2.9.10 | Vulnerable | FasterXML |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* | 7.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | 7.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
- cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.8.11.5; 2.9.0 to before 2.9.10 Vulnerable ·FasterXML
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* Versions 7.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* | before 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* | 19.1.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions before 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:* Versions 19.1.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-f3j5-rmmp-3fc5 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.10 Advisory →
- Fix · GHSA-f3j5-rmmp-3fc5 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11.5 Advisory →
Red Hat 13 advisories
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2020:2333 Released 2020-05-28 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 19 security update
- EAP-CD 19 Tech Preview
- RHSA-2020:2321 Released 2020-05-26 · Red Hat rating ImportantRed Hat Data Grid 7.3.6 security update
- Red Hat Data Grid 7.3.6
Show 10 more Red Hat advisories
- RHSA-2020:2067 Released 2020-05-18 · Red Hat rating ImportantRed Hat build of Thorntail 2.5.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:0899 Released 2020-03-18 · Red Hat rating ImportantRed Hat Decision Manager 7.7.0 Security Update
- Red Hat Decision Manager 7
- RHSA-2020:0895 Released 2020-03-18 · Red Hat rating ModerateRed Hat Process Automation Manager 7.7.0 Security Update
- Red Hat Process Automation 7
- RHSA-2020:0445 Released 2020-02-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.6 security update
- Red Hat Single Sign-On 7.3
- RHSA-2020:0160 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el7eap +47
- RHSA-2020:0161 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el8eap +47
- RHSA-2020:0159 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el6eap +47
- RHSA-2020:0164 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 security update
- Red Hat JBoss EAP 7.2
- RHSA-2019:3901 Released 2019-11-18 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Vert.x 3.8.3 security update
- Red Hat Openshift Application Runtimes Vert.x 3.8.3
- RHSA-2019:3200 Released 2019-10-24 · Red Hat rating ModerateRed Hat AMQ Streams 1.3.0 release and security update
- Red Hat AMQ Streams 1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat Mobile Application Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.10 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| EAP-CD 19 Tech Preview | Fixed | RHSA-2020:2333 |
| Red Hat AMQ Streams 1 | Fixed | RHSA-2019:3200 |
| Red Hat Data Grid 7.3.6 | Fixed | RHSA-2020:2321 |
| Red Hat Decision Manager 7 | Fixed | RHSA-2020:0899 |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:0164 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:0159 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:0160 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:0161 |
| Red Hat Openshift Application Runtimes Vert.x 3.8.3 | Fixed | RHSA-2019:3901 |
| Red Hat Process Automation 7 | Fixed | RHSA-2020:0895 |
| Red Hat Single Sign-On 7.3 | Fixed | RHSA-2020:0445 |
| Text-Only RHOAR | Fixed | RHSA-2020:2067 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17267
- 2026-10-03 Alias added: GHSA-f3j5-rmmp-3fc5
- 2026-10-07 CVSS score added · CISA ADP
- 2026-10-07 Weakness changed · CISA ADP
- 2026-10-07 CISA SSVC decision points changed
References
Advisory 13
- RHSA-2019:3200
- [debian-lts-announce] 20191210 [SECURITY] [DLA 2030-1] jackson-databind security update
- RHSA-2020:0164
- RHSA-2020:0159
- RHSA-2020:0160
- RHSA-2020:0161
- RHSA-2020:0445
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20191017-0006/
- https://github.com/FasterXML/jackson-databind/issues/2460
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-17267
Other 17
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [druid-commits] 20200115 [druid] branch 0.17.0 updated: Suppress CVE-2019-20330 for htrace-core-4.0.1 (#9189) (#9191)
- [skywalking-dev] 20200324 [CVE-2019-17267] Upgrade jackson-databind version to 2.9.10
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12
- https://github.com/FasterXML/jackson-databind/commit/191a4cdf87b56d2ddddb77edd895ee756b7f75eb
- https://security.netapp.com/advisory/ntap-20191017-0006
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
- https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8@%3Cdev.skywalking.apache.org%3E
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://github.com/FasterXML/jackson-databind
Sources
- CVE-2019-17267 · CVE Program
- CVE-2019-17267 · NVD
- FIRST EPSS
- GHSA-f3j5-rmmp-3fc5 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-17267 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences