CVE-2019-14893Published
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type …
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2019-14893 · Microsoft / collected KEV context
cve-program · CVE-2019-14893
- https://access.redhat.com/errata/RHSA-2020:0729
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893
- https://github.com/FasterXML/jackson-databind/issues/2469
- https://security.netapp.com/advisory/ntap-20200327-0006/
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.