CVE-2019-14892: jackson-databind from 2.0.0 (inclusive), before 2.6.7.3 (exclusive), from 2.7.0 (inclusive), before 2.8.11.5…

Affected technology

jackson-databind · from 2.0.0 (inclusive), before 2.6.7.3 (exclusive)
fasterxml

jackson-databind · from 2.7.0 (inclusive), before 2.8.11.5 (exclusive)
fasterxml

jackson-databind · from 2.9.0 (inclusive), before 2.9.10 (exclusive)
fasterxml

decision manager · 7.0
redhat

jboss data grid · Version not applicable in the source CPE
redhat

jboss data grid · 7.0.0
redhat

jboss enterprise application platform · 7.0
redhat

jboss fuse · 7.0.0
redhat

openshift container platform · 4.3
redhat

process automation · 7.0
redhat

geode · 1.12.0
apache

jackson-databind · Versions before 2.9.10, Versions before 2.8.11.5, Versions before 2.6.7.3
Red Hat

Description’s affected range: versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI c

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker could use this flaw to execute arbitrary code. NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.