Critical severity9.8NVD Advisory· Published Oct 12, 2019· Updated Jun 17, 2026

CVE-2019-17531

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.9.0, < 2.9.10.1	2.9.10.1
com.fasterxml.jackson.core:jackson-databindMaven	>= 2.7.0, < 2.8.11.5	2.8.11.5
com.fasterxml.jackson.core:jackson-databindMaven	< 2.6.7.3	2.6.7.3

Affected products

Fasterxml/Jackson Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
Range: >=2.0.0,<2.6.7.3
NetApp/Oncommand Workflow Automation
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
NetApp/Steelstore Cloud Integrated Storage
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform9 versions
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Billing And Revenue Management2 versions
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Calendar Server2 versions
cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Cloud Native Core Network Slice Selection Function
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:*
Oracle Corporation/Communications Evolved Communications Application Server
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
Oracle Corporation/Global Lifecycle Management Nextgen Oui Framework3 versions
cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*
Oracle Corporation/Goldengate Application Adapters
cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone Orchestrator
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
Oracle Corporation/Jd Edwards Enterpriseone
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
Oracle Corporation/Primavera Gateway4 versions
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*range: >=17.7,<=17.12.6
- cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Merchandising System3 versions
cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:retail_merchandising_system:15.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Retail Sales Audit
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*
Oracle Corporation/Siebel Engineering Installer \& Deployment
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
Range: <=2.20.5
Oracle Corporation/Trace File Analyzer3 versions
cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:trace_file_analyzer:12.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:trace_file_analyzer:18c:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:trace_file_analyzer:19c:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal2 versions
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Sites2 versions
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Weblogic Server2 versions
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
Red Hat/Jboss Enterprise Application Platform2 versions
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
FasterXML/jackson-databinddescription
ghsa-coords31 versions
pkg:maven/com.fasterxml.jackson.core/jackson-databind pkg:rpm/almalinux/apache-commons-collections pkg:rpm/almalinux/apache-commons-lang pkg:rpm/almalinux/bea-stax-api pkg:rpm/almalinux/glassfish-fastinfoset pkg:rpm/almalinux/glassfish-jaxb-api pkg:rpm/almalinux/glassfish-jaxb-core pkg:rpm/almalinux/glassfish-jaxb-runtime pkg:rpm/almalinux/glassfish-jaxb-txw2 pkg:rpm/almalinux/jackson-annotations pkg:rpm/almalinux/jackson-core pkg:rpm/almalinux/jackson-databind pkg:rpm/almalinux/jackson-jaxrs-json-provider pkg:rpm/almalinux/jackson-jaxrs-providers pkg:rpm/almalinux/jackson-module-jaxb-annotations pkg:rpm/almalinux/jakarta-commons-httpclient pkg:rpm/almalinux/javassist pkg:rpm/almalinux/javassist-javadoc pkg:rpm/almalinux/python-nss-doc pkg:rpm/almalinux/python3-nss pkg:rpm/almalinux/relaxngDatatype pkg:rpm/almalinux/slf4j pkg:rpm/almalinux/slf4j-jdk14 pkg:rpm/almalinux/stax-ex pkg:rpm/almalinux/velocity pkg:rpm/almalinux/xalan-j2 pkg:rpm/almalinux/xerces-j2 pkg:rpm/almalinux/xml-commons-apis pkg:rpm/almalinux/xml-commons-resolver pkg:rpm/almalinux/xmlstreambuffer pkg:rpm/almalinux/xsom
>= 2.9.0, < 2.9.10.1+ 30 more
- (no CPE)range: >= 2.9.0, < 2.9.10.1
- (no CPE)range: < 3.2.2-10.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.6-21.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.0-16.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2.13-9.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.12-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.2.11-11.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.10.0-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.9.9-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.9.9-1.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.6-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1:3.1-28.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 3.18.1-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
- (no CPE)range: < 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma
- (no CPE)range: < 2011.1-7.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.25-4.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7.7-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.7-24.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.7.1-38.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 2.11.0-34.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.4.01-25.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.2-26.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 1.5.4-8.module_el8.5.0+2577+9e95fe00
- (no CPE)range: < 0-19.20110809svn.module_el8.5.0+2577+9e95fe00

Patches

Vulnerability mechanics

References

github.com/FasterXML/jackson-databind/issues/2498nvdPatchThird Party AdvisoryWEB
www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2019:4192nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0159nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0160nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0161nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0164nvdThird Party AdvisoryWEB
access.redhat.com/errata/RHSA-2020:0445nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-gjmw-vf9h-g25vghsaADVISORY
lists.debian.org/debian-lts-announce/2019/12/msg00013.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-17531ghsaADVISORY
security.netapp.com/advisory/ntap-20191024-0005/nvdThird Party Advisory
www.oracle.com/security-alerts/cpuapr2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2020.htmlnvdThird Party AdvisoryWEB
github.com/FasterXML/jackson-databind/commit/b5a304a98590b6bb766134f9261e6566dcbbb6d0ghsaWEB
lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5@%3Ccommits.pulsar.apache.org%3EghsaWEB
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3EghsaWEB
lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3EghsaWEB
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3EghsaWEB
medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062ghsaWEB
security.netapp.com/advisory/ntap-20191024-0005ghsaWEB
lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3Envd
lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Envd
lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3Envd
lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Envd
medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.004
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000