CVE-2019-16943 json
jackson-databind polymorphic typing issue
published 7y ago modified last mo. also GHSA-fmmc-742q-jg75 , EUVD-2019-0747
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.7%
- EPSS 4.7% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Patch / fix
- maven com.fasterxml.jackson.core:jackson-databind 2.6.7.3, 2.8.11.5, 2.9.10.1
- fasterxml jackson-databind 2.6.7.3, 2.8.11.5, 2.9.10.1
- jackson-databind Debian 14, Debian 13, Debian 12 2.10.0-2
debian advisories DEBIAN-CVE-2019-16943
- jackson-databind Ubuntu Pro 16.04 LTS 2.4.2-3ubuntu0.1~esm2
ubuntu advisories UBUNTU-CVE-2019-16943
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- eap7-netty jboss enterprise application platform 7.2 4.1.42-1.Final_redhat_00001.1.el8eap
- eap7-jberet jboss enterprise application platform 7.2 1.3.5-1.Final_redhat_00001.1.el8eap
- eap7-wildfly jboss enterprise application platform 7.2 7.2.6-5.GA_redhat_00001.1.el8eap
- eap7-undertow jboss enterprise application platform 7.2 2.0.28-2.SP1_redhat_00001.1.el8eap
- eap7-weld-ejb jboss enterprise application platform 7.2 3.0.6-3.Final_redhat_00003.1.el8eap
- eap7-weld-jta jboss enterprise application platform 7.2 3.0.6-3.Final_redhat_00003.1.el8eap
- eap7-weld-web jboss enterprise application platform 7.2 3.0.6-3.Final_redhat_00003.1.el8eap
- eap7-hibernate jboss enterprise application platform 7.2 5.3.14-1.Final_redhat_00001.1.el8eap
red hat advisories RHSA-2020:0161RHSA-2020:0160RHSA-2020:0159RHSA-2020:1644
- xsom AlmaLinux 8 0-19.20110809svn.module_el8.5.0+2577+9e95fe00
- slf4j AlmaLinux 8 1.7.25-4.module_el8.5.0+2577+9e95fe00
- stax-ex AlmaLinux 8 1.7.7-8.module_el8.5.0+2577+9e95fe00
- velocity AlmaLinux 8 1.7-24.module_el8.5.0+2577+9e95fe00
- xalan-j2 AlmaLinux 8 2.7.1-38.module_el8.5.0+2577+9e95fe00
- javassist AlmaLinux 8 3.18.1-8.module_el8.5.0+2577+9e95fe00
- xerces-j2 AlmaLinux 8 2.11.0-34.module_el8.5.0+2577+9e95fe00
- python3-nss AlmaLinux 8 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
almalinux advisories ALSA-2020:1644
- xsom Rocky Linux 8 0-19.20110809svn.module+el8.3.0+53+ea062990
- slf4j Rocky Linux 8 1.7.25-4.module+el8.5.0+697+f586bb30
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+74+855e3f5d
- slf4j Rocky Linux 8 1.7.25-4.module+el8.3.0+133+b8b54b58
- stax-ex Rocky Linux 8 1.7.7-8.module+el8.3.0+53+ea062990
- bea-stax Rocky Linux 8 1.2.0-16.module+el8.3.0+53+ea062990
- resteasy Rocky Linux 8 3.0.26-3.module+el8.3.0+53+ea062990
- velocity Rocky Linux 8 1.7-24.module+el8.3.0+53+ea062990
rocky linux advisories RLSA-2020:1644
Is CVE-2019-16943 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-16943 updated cvss 7.5
jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource
-
Red Hat BPM Suite 6 jackson-databind Red Hat JBoss A-MQ 6 jackson-databind Red Hat JBoss Data Virtualization 6 jackson-databind Red Hat JBoss Fuse 6 jackson-databind Red Hat Mobile Application Platform 4 jackson-databindaffected: workaround, no fix planned “Out of support scope”
-
Red Hat OpenShift Application Runtimes jackson-databindaffected: workaround, no fix available
-
Red Hat OpenShift Container Platform 3.9 elasticsearch-cloud-kubernetes, openshift-elasticsearch-plugin Red Hat OpenShift Container Platform 3.10 elasticsearch-cloud-kubernetes, openshift-elasticsearch-plugin Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 Red Hat OpenShift Container Platform 4 openshift4/ose-logging-elasticsearch5affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenStack Platform 10 (Newton) opendaylightaffected: workaround, no fix planned “Out of support scope”
-
Red Hat OpenStack Platform 13 (Queens) opendaylight Red Hat OpenStack Platform 14 (Rocky) opendaylight Red Hat Software Collections rh-maven35-jackson-databind, rh-maven35-jackson-databind-javadocaffected: workaround, no fix planned “Will not fix”
-
Red Hat EAP-CD 19 Tech Previewfixed: vendor fix RHSA-2020:2333
-
Red Hat AMQ Streams 1fixed: vendor fix RHSA-2020:0939
-
Red Hat Data Grid 7.3.6fixed: vendor fix RHSA-2020:2321
show 12 moreshow fewer
-
Red Hat Decision Manager 7fixed: vendor fix RHSA-2020:0899
-
Red Hat Enterprise Linux AppStream (v. 8) jss 4.6.2-4.module+el8.2.0+6123+b4678599, slf4j 1.7.25-4.module+el8.1.0+3366+6dfb954c, pki-ca 10.8.3-1.module+el8.2.0+5925+bad5981a, stax-ex 1.7.7-8.module+el8.1.0+3366+6dfb954c, velocity 1.7-24.module+el8.1.0+3366+6dfb954c, ldapjdk 4.21.0-2.module+el8.2.0+4573+c3c38c7b, +43 morefixed: vendor fix RHSA-2020:1644
-
Red Hat Fuse 7.7.0fixed: vendor fix RHSA-2020:3192
-
Red Hat JBoss EAP 7.2fixed: vendor fix RHSA-2020:0164
-
Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-wildfly 7.2.6-5.GA_redhat_00001.1.el6eap, eap7-apache-cxf 3.2.11-1.redhat_00001.1.el6eap, eap7-jberet 1.3.5-1.Final_redhat_00001.1.el6eap, eap7-netty 4.1.42-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.9.10-1.redhat_00003.1.el6eap, eap7-undertow 2.0.28-2.SP1_redhat_00001.1.el6eap, +71 morefixed: vendor fix RHSA-2020:0159
-
Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-wildfly 7.2.6-5.GA_redhat_00001.1.el7eap, eap7-apache-cxf 3.2.11-1.redhat_00001.1.el7eap, eap7-jberet 1.3.5-1.Final_redhat_00001.1.el7eap, eap7-netty 4.1.42-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.9.10-1.redhat_00003.1.el7eap, eap7-undertow 2.0.28-2.SP1_redhat_00001.1.el7eap, +73 morefixed: vendor fix RHSA-2020:0160
-
Red Hat JBoss EAP 7.2 for RHEL 8 eap7-wildfly 7.2.6-5.GA_redhat_00001.1.el8eap, eap7-apache-cxf 3.2.11-1.redhat_00001.1.el8eap, eap7-jberet 1.3.5-1.Final_redhat_00001.1.el8eap, eap7-netty 4.1.42-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.9.10-1.redhat_00003.1.el8eap, eap7-undertow 2.0.28-2.SP1_redhat_00001.1.el8eap, +71 morefixed: vendor fix RHSA-2020:0161
-
Red Hat Openshift Application Runtimes Vert.x 3.8.3fixed: vendor fix RHSA-2019:3901
-
Red Hat Process Automation 7fixed: vendor fix RHSA-2020:0895
-
Red Hat Single Sign-On 7.3fixed: vendor fix RHSA-2020:0445
-
Red Hat Text-Only RHOARfixed: vendor fix RHSA-2020:2067
-
Red Hat Satellite 6 candlepin, candlepin-selinuxnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
4.74% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.fasterxml.jackson.core:jackson-databind | >=2.9.0, <2.9.10.1 >=2.7.0, <2.8.11.5 <2.6.7.3 |
2.9.10.1 2.8.11.5 2.6.7.3 |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/FasterXML/jackson-databind/issues/2478
web, patch, third-party-advisory
-
oracle.com
/security-alerts/cpuoct2020.html
web, patch, third-party-advisory
-
oracle.com
//security-alerts/cpujul2021.html
web, patch, third-party-advisory
-
github.com
/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b
web
-
github.com
/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f
web
-
debian.org
/security/2019/dsa-4542
vendor-advisory, web, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/
vendor-advisory
-
access.redhat.com
/errata/RHSA-2020:0164
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0159
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0160
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0161
vendor-advisory, web, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0445
vendor-advisory, web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/10/msg00001.html
mailing-list, web, third-party-advisory
-
seclists.org
/bugtraq/2019/Oct/6
mailing-list, web, issue-tracking, third-party-advisory
-
lists.apache.org
/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd%40%3Ccommits.iceberg.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E
mailing-list
- medium.com /%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
-
oracle.com
/security-alerts/cpuapr2020.html
web, third-party-advisory
-
oracle.com
/security-alerts/cpujul2020.html
web, third-party-advisory
-
oracle.com
/security-alerts/cpujan2020.html
web, third-party-advisory
-
security.netapp.com
/advisory/ntap-20191017-0006/
third-party-advisory
-
lists.apache.org
/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2019-16943
advisory
-
lists.apache.org
/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT
web
-
medium.com
/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
web
-
security.netapp.com
/advisory/ntap-20191017-0006
web
-
lists.apache.org
/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E
web
-
lists.apache.org
/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
web
-
lists.apache.org
/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
web
-
lists.apache.org
/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
web
-
lists.apache.org
/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E
web
-
lists.apache.org
/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd@%3Ccommits.iceberg.apache.org%3E
web
-
lists.apache.org
/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
web
-
github.com
/FasterXML/jackson-databind
package
Sources
- CVE List CVE-2019-16943
- GitHub Advisory GHSA-fmmc-742q-jg75
- NVD CVE-2019-16943
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.