7.5
High
CVE-2019-14892 A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit…
Description
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jackson-databind | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- github.com github.com
- RHSA-2020:0729 access.redhat.com
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image lists.apache.org
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 lists.apache.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified