Critical severity9.8NVD Advisory· Published Oct 1, 2019· Updated Jun 17, 2026

CVE-2019-16943

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.9.0, < 2.9.10.1	2.9.10.1
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.7.0, < 2.8.11.5	2.8.11.5
com.fasterxml.jackson.core:jackson-databindMaven	< 2.6.7.3	2.6.7.3

Affected products

Fasterxml/Jackson Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Range: >=2.0.0,<2.6.7.3
NetApp/Active Iq Unified Manager3 versions
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*+ 2 more
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*range: >=7.3
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*range: >=9.5
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*range: >=7.3
NetApp/Oncommand API Services
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
NetApp/Oncommand Workflow Automation
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
NetApp/Service Level Manager
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
NetApp/Steelstore Cloud Integrated Storage
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform9 versions
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Billing And Revenue Management2 versions
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Calendar Server2 versions
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Slice Selection Function
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Evolved Communications Application Server
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
Oracle Corporation/Global Lifecycle Management Nextgen Oui Framework3 versions
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
Oracle Corporation/Goldengate Application Adapters
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone Orchestrator
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
Oracle Corporation/Primavera Gateway4 versions
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*range: >=17.7,<=17.12.6
- cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System3 versions
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Retail Sales Audit
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
Oracle Corporation/Siebel Engineering Installer \& Deployment
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
Range: <=2.20.5
Oracle Corporation/Trace File Analyzer3 versions
cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal2 versions
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Sites2 versions
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Weblogic Server2 versions
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
Red Hat/Jboss Enterprise Application Platform2 versions
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
FasterXML/jackson-databinddescription
ghsa-coords31 versions
pkg:maven/com.fasterxml.jackson.core/jackson-databind pkg:rpm/almalinux/apache-commons-collections pkg:rpm/almalinux/apache-commons-lang pkg:rpm/almalinux/bea-stax-api pkg:rpm/almalinux/glassfish-fastinfoset pkg:rpm/almalinux/glassfish-jaxb-api pkg:rpm/almalinux/glassfish-jaxb-core pkg:rpm/almalinux/glassfish-jaxb-runtime pkg:rpm/almalinux/glassfish-jaxb-txw2 pkg:rpm/almalinux/jackson-annotations pkg:rpm/almalinux/jackson-core pkg:rpm/almalinux/jackson-databind pkg:rpm/almalinux/jackson-jaxrs-json-provider pkg:rpm/almalinux/jackson-jaxrs-providers pkg:rpm/almalinux/jackson-module-jaxb-annotations pkg:rpm/almalinux/jakarta-commons-httpclient pkg:rpm/almalinux/javassist pkg:rpm/almalinux/javassist-javadoc pkg:rpm/almalinux/python-nss-doc pkg:rpm/almalinux/python3-nss pkg:rpm/almalinux/relaxngDatatype pkg:rpm/almalinux/slf4j pkg:rpm/almalinux/slf4j-jdk14 pkg:rpm/almalinux/stax-ex pkg:rpm/almalinux/velocity pkg:rpm/almalinux/xalan-j2 pkg:rpm/almalinux/xerces-j2 pkg:rpm/almalinux/xml-commons-apis pkg:rpm/almalinux/xml-commons-resolver pkg:rpm/almalinux/xmlstreambuffer pkg:rpm/almalinux/xsom
>= 2.9.0, < 2.9.10.1+ 30 more
- (no CPE)range: >= 2.9.0, < 2.9.10.1
- (no CPE)range: < 3.2.2-10.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.6-21.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.0-16.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.13-9.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.12-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.9.9-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.9.9-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.6-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1:3.1-28.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
- (no CPE)range: < 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
- (no CPE)range: < 2011.1-7.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.7-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7-24.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.1-38.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.11.0-34.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.4.01-25.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2-26.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.5.4-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 0-19.20110809svn.module_el8.5.0+2577+9e95fe00

Patches

Vulnerability mechanics

References

github.com/FasterXML/jackson-databind/issues/2478nvdPatchThird Party AdvisoryWEB
www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0159nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0160nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0161nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0164nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0445nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-fmmc-742q-jg75ghsaADVISORY
lists.debian.org/debian-lts-announce/2019/10/msg00001.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-16943ghsaADVISORY
seclists.org/bugtraq/2019/Oct/6nvdIssue TrackingMailing ListThird Party AdvisoryWEB
security.netapp.com/advisory/ntap-20191017-0006/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4542nvdMailing ListThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2020.htmlnvdThird Party AdvisoryWEB
github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0bghsaWEB
github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779fghsaWEB
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3EghsaWEB
lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd@%3Ccommits.iceberg.apache.org%3EghsaWEB
lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3EghsaWEB
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3EghsaWEB
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3EghsaWEB
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3EghsaWEB
lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3EghsaWEB
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3EghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43ghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJTghsaWEB
medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062ghsaWEB
security.netapp.com/advisory/ntap-20191017-0006ghsaWEB
lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Envd
lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd%40%3Ccommits.iceberg.apache.org%3Envd
lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3Envd
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Envd
lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Envd
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Envd
lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3Envd
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Envd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/nvd
medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000