Home

CVE-2019-14379

Description

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
1.455

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2019-14439,CVE-2019-14379 are fixed in Jackson-databind 2.9.9.2Windows
Vulnerabilities CVE-2019-14439,CVE-2019-14379,CVE-2019-12814,CVE-2019-12384,CVE-2019-12086 are fixed in Jackson-databind 2.7.9.6Windows
Vulnerabilities CVE-2019-14439,CVE-2019-14379,CVE-2019-12814,CVE-2019-12384,CVE-2019-12086 are fixed in Jackson-databind 2.8.11.4Windows
Multiple Vulnerabilities are affected in Netapp Snapcenter -Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Workflow Automation -Windows
Multiple Vulnerabilities are affected in Netapp Active Iq Unified Manager 2.3Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.2Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.3Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2.6.5Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.0Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.0Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.0.6Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.2Windows
Vulnerabilities CVE-2019-14439,CVE-2019-14379 are fixed in Jackson-databind for Linux 2.9.9.2Linux
Vulnerabilities CVE-2019-14439,CVE-2019-14379,CVE-2019-12814,CVE-2019-12384,CVE-2019-12086 are fixed in Jackson-databind for Linux 2.7.9.6Linux
Vulnerabilities CVE-2019-14439,CVE-2019-14379,CVE-2019-12814,CVE-2019-12384,CVE-2019-12086 are fixed in Jackson-databind for Linux 2.8.11.4Linux
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) Vulnerability (CVE-2019-14379)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234