// For flags

CVE-2019-17267

jackson-databind: Serialization gadgets in classes of the ehcache package

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Se detectó un problema de Escritura Polimórfica en FasterXML jackson-databind versiones anteriores a 2.9.10. Está relacionado con net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model & Notation execution, and Business Optimizer for solving planning problems. It automates business decisions and makes that logic available to the entire business. This release of Red Hat Decision Manager 7.7.0 serves as an update to Red Hat Decision Manager 7.6.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and information leakage vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-10-06 CVE Reserved
  • 2019-10-06 CVE Published
  • 2024-08-05 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (22)
URL Tag Source
https://github.com/FasterXML/jackson-databind/issues/2460 Issue Tracking
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8%40%3Cdev.skywalking.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E Mailing List
https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html Mailing List
https://security.netapp.com/advisory/ntap-20191017-0006 Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
URL Date SRC
URL Date SRC
https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10 2023-11-07
URL Date SRC
https://access.redhat.com/errata/RHSA-2019:3200 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0159 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0160 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0161 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0164 2023-11-07
https://access.redhat.com/errata/RHSA-2020:0445 2023-11-07
https://access.redhat.com/security/cve/CVE-2019-17267 2020-07-28
https://bugzilla.redhat.com/show_bug.cgi?id=1758167 2020-07-28
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.2
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 6.0
Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"
-
Safe
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.2
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 7.0
Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"
-
Safe
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.2
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.2"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 8.0
Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"
-
Safe
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.3
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.3"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 6.0
Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"
-
Safe
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.3
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.3"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 7.0
Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"
-
Safe
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.3
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.3"
-
Affected
in Redhat
Search vendor "Redhat"
 Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
 8.0
Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"
-
Safe
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.0.0 < 2.8.11.5
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.0.0 < 2.8.11.5"
-
Affected
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.9.0 < 2.9.10
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.9.0 < 2.9.10"
-
Affected
Netapp
Search vendor "Netapp"
 Active Iq Unified Manager
Search vendor "Netapp" for product "Active Iq Unified Manager"
 >= 7.3
Search vendor "Netapp" for product "Active Iq Unified Manager" and version " >= 7.3"
linux
Affected
Netapp
Search vendor "Netapp"
 Active Iq Unified Manager
Search vendor "Netapp" for product "Active Iq Unified Manager"
 >= 7.3
Search vendor "Netapp" for product "Active Iq Unified Manager" and version " >= 7.3"
windows
Affected
Netapp
Search vendor "Netapp"
 Active Iq Unified Manager
Search vendor "Netapp" for product "Active Iq Unified Manager"
 >= 9.5
Search vendor "Netapp" for product "Active Iq Unified Manager" and version " >= 9.5"
vmware_vsphere
Affected
Netapp
Search vendor "Netapp"
 Oncommand Api Services
Search vendor "Netapp" for product "Oncommand Api Services"
--
Affected
Netapp
Search vendor "Netapp"
 Oncommand Workflow Automation
Search vendor "Netapp" for product "Oncommand Workflow Automation"
--
Affected
Netapp
Search vendor "Netapp"
 Service Level Manager
Search vendor "Netapp" for product "Service Level Manager"
--
Affected
Netapp
Search vendor "Netapp"
 Steelstore Cloud Integrated Storage
Search vendor "Netapp" for product "Steelstore Cloud Integrated Storage"
--
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Oracle
Search vendor "Oracle"
 Customer Management And Segmentation Foundation
Search vendor "Oracle" for product "Customer Management And Segmentation Foundation"
 < 18.0
Search vendor "Oracle" for product "Customer Management And Segmentation Foundation" and version " < 18.0"
-
Affected
Oracle
Search vendor "Oracle"
 Goldengate Application Adapters
Search vendor "Oracle" for product "Goldengate Application Adapters"
 19.1.0.0.0
Search vendor "Oracle" for product "Goldengate Application Adapters" and version "19.1.0.0.0"
-
Affected
Oracle
Search vendor "Oracle"
 Retail Customer Management And Segmentation Foundation
Search vendor "Oracle" for product "Retail Customer Management And Segmentation Foundation"
 17.0
Search vendor "Oracle" for product "Retail Customer Management And Segmentation Foundation" and version "17.0"
-
Affected
Oracle
Search vendor "Oracle"
 Weblogic Server
Search vendor "Oracle" for product "Weblogic Server"
 12.2.1.3.0
Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.3.0"
-
Affected