Critical severity9.8NVD Advisory· Published Oct 1, 2019· Updated Jun 17, 2026

CVE-2019-16942

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.9.0, < 2.9.10.1	2.9.10.1
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.7.0, < 2.8.11.5	2.8.11.5
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.0.0, < 2.6.7.3	2.6.7.3

Affected products

Fasterxml/Jackson Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Range: >=2.0.0,<2.6.7.3
NetApp/Active Iq Unified Manager3 versions
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*+ 2 more
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*range: >=7.3
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*range: >=9.5
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*range: >=7.3
NetApp/Oncommand API Services
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
NetApp/Oncommand Workflow Automation
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
NetApp/Service Level Manager
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
NetApp/Steelstore Cloud Integrated Storage
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform9 versions
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Billing And Revenue Management2 versions
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Calendar Server2 versions
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Slice Selection Function
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Evolved Communications Application Server
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
Oracle Corporation/Database Server3 versions
cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:*
Oracle Corporation/Global Lifecycle Management Nextgen Oui Framework3 versions
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
Oracle Corporation/Goldengate Application Adapters
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone Orchestrator
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
Oracle Corporation/Primavera Gateway2 versions
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*range: >=17.12.0,<=17.12.6
- cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*
Oracle Corporation/Primavera Unifier5 versions
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*range: >=17.7,<=17.12
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System3 versions
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Retail Sales Audit
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
Oracle Corporation/Siebel Engineering Installer \& Deployment
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
Range: <=2.20.5
Oracle Corporation/Siebel UI Framework2 versions
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*range: <=20.5
- cpe:2.3:a:oracle:siebel_ui_framework:20.6:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal2 versions
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Sites2 versions
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Weblogic Server2 versions
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
Red Hat/Jboss Enterprise Application Platform2 versions
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
FasterXML/jackson-databinddescription
ghsa-coords31 versions
pkg:maven/com.fasterxml.jackson.core/jackson-databind pkg:rpm/almalinux/apache-commons-collections pkg:rpm/almalinux/apache-commons-lang pkg:rpm/almalinux/bea-stax-api pkg:rpm/almalinux/glassfish-fastinfoset pkg:rpm/almalinux/glassfish-jaxb-api pkg:rpm/almalinux/glassfish-jaxb-core pkg:rpm/almalinux/glassfish-jaxb-runtime pkg:rpm/almalinux/glassfish-jaxb-txw2 pkg:rpm/almalinux/jackson-annotations pkg:rpm/almalinux/jackson-core pkg:rpm/almalinux/jackson-databind pkg:rpm/almalinux/jackson-jaxrs-json-provider pkg:rpm/almalinux/jackson-jaxrs-providers pkg:rpm/almalinux/jackson-module-jaxb-annotations pkg:rpm/almalinux/jakarta-commons-httpclient pkg:rpm/almalinux/javassist pkg:rpm/almalinux/javassist-javadoc pkg:rpm/almalinux/python-nss-doc pkg:rpm/almalinux/python3-nss pkg:rpm/almalinux/relaxngDatatype pkg:rpm/almalinux/slf4j pkg:rpm/almalinux/slf4j-jdk14 pkg:rpm/almalinux/stax-ex pkg:rpm/almalinux/velocity pkg:rpm/almalinux/xalan-j2 pkg:rpm/almalinux/xerces-j2 pkg:rpm/almalinux/xml-commons-apis pkg:rpm/almalinux/xml-commons-resolver pkg:rpm/almalinux/xmlstreambuffer pkg:rpm/almalinux/xsom
>= 2.9.0, < 2.9.10.1+ 30 more
- (no CPE)range: >= 2.9.0, < 2.9.10.1
- (no CPE)range: < 3.2.2-10.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.6-21.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.0-16.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.13-9.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.12-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.9.9-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.9.9-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.6-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1:3.1-28.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
- (no CPE)range: < 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
- (no CPE)range: < 2011.1-7.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.7-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7-24.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.1-38.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.11.0-34.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.4.01-25.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2-26.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.5.4-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 0-19.20110809svn.module_el8.5.0+2577+9e95fe00

Patches

Vulnerability mechanics

References

github.com/FasterXML/jackson-databind/issues/2478nvdPatchThird Party AdvisoryWEB
www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2019:3901nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0159nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0160nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0161nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0164nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0445nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-mx7p-6679-8g3qghsaADVISORY
issues.apache.org/jira/browse/GEODE-7255nvdIssue TrackingThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2019/10/msg00001.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-16942ghsaADVISORY
seclists.org/bugtraq/2019/Oct/6nvdIssue TrackingMailing ListThird Party AdvisoryWEB
security.netapp.com/advisory/ntap-20191017-0006/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4542nvdMailing ListThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2020.htmlnvdThird Party AdvisoryWEB
github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0bghsaWEB
github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8ghsaWEB
github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddacghsaWEB
github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779fghsaWEB
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3EghsaWEB
lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5@%3Cissues.geode.apache.org%3EghsaWEB
lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954@%3Cissues.geode.apache.org%3EghsaWEB
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3EghsaWEB
lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370@%3Cissues.geode.apache.org%3EghsaWEB
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3EghsaWEB
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3EghsaWEB
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3EghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43ghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJTghsaWEB
medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062ghsaWEB
security.netapp.com/advisory/ntap-20191017-0006ghsaWEB
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Envd
lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5%40%3Cissues.geode.apache.org%3Envd
lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954%40%3Cissues.geode.apache.org%3Envd
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Envd
lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370%40%3Cissues.geode.apache.org%3Envd
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Envd
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Envd
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Envd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/nvd
medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.005
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000