VYPR
← All advisories
Critical severityNVD Advisory· Published Jul 29, 2019· Updated Aug 5, 2024

CVE-2019-14379

CVE-2019-14379

Description

FasterXML jackson-databind before 2.9.9.2 mishandles default typing with ehcache, allowing remote code execution via crafted JSON.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FasterXML jackson-databind before 2.9.9.2 mishandles default typing with ehcache, allowing remote code execution via crafted JSON.

Vulnerability

Overview

CVE-2019-14379 is a remote code execution vulnerability in FasterXML jackson-databind versions prior to 2.9.9.2. The flaw resides in SubTypeValidator.java, which fails to properly validate types when default typing is enabled. Specifically, when the net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup class from the Ehcache library is present on the classpath, an attacker can bypass type restrictions and instantiate arbitrary classes [4].

Exploitation

Conditions

Exploitation requires that default typing is enabled in the Jackson ObjectMapper (e.g., via @JsonTypeInfo or ObjectMapper.enableDefaultTyping()) and that the Ehcache library is available. An attacker can send a specially crafted JSON payload that triggers the instantiation of a malicious class, leading to arbitrary code execution. No authentication is required if the application deserializes untrusted JSON input [4].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected application. This can lead to full system compromise, data theft, or further lateral movement within the network. The vulnerability is rated critical with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) [4].

Mitigation

The vulnerability is fixed in jackson-databind version 2.9.9.2 and later. Red Hat has released patches for JBoss Enterprise Application Platform (EAP) versions 7.3 and 7.4 across RHEL 6, 7, and 8, as documented in RHSA-2019:2935, RHSA-2019:2936, and RHSA-2019:2937 [1][2][3]. Users should upgrade to the patched versions or disable default typing if not required.

References
  1. https://access.redhat.com/errata/RHSA-2019:2937
  2. https://access.redhat.com/errata/RHSA-2019:2936
  3. https://access.redhat.com/errata/RHSA-2019:2935
  4. NVD - CVE-2019-14379

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.9.0, < 2.9.9.22.9.9.2
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.8.0, < 2.8.11.42.8.11.4
com.fasterxml.jackson.core:jackson-databindMaven
< 2.7.9.62.7.9.6

Affected products

2

Patches

1
ad418eeb974e

Backport #2387, #2389 fixes

https://github.com/FasterXML/jackson-databindTatu SalorantaJul 26, 2019via ghsa
commit
1 file changed · +6 −0
  • src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java+6 −0 modified
    @@ -89,6 +89,12 @@ public class SubTypeValidator
         s.add("org.jdom.transform.XSLTransformer");
         s.add("org.jdom2.transform.XSLTransformer");
 
+        // [databind#2387]: EHCache
+        s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");
+
+        // [databind#2389]: logback/jndi
+        s.add("ch.qos.logback.core.db.JNDIConnectionSource");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

92

News mentions

0

No linked articles in our index yet.