Description
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Published: 2019-07-29
Score: 9.8 Critical
EPSS: 8.1% Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-1879-1 jackson-databind security update
EUVD EUVD EUVD-2019-0625 SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Github GHSA Github GHSA GHSA-6fpp-rgj9-8rwc Deserialization of untrusted data in FasterXML jackson-databind
Ubuntu USN Ubuntu USN USN-4813-1 Jackson Databind vulnerabilities
References
Link Providers
http://seclists.org/fulldisclosure/2022/Mar/23 cve-icon cve-icon
https://access.redhat.com/errata/RHBA-2019:2824 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2743 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2858 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2935 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2936 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2937 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2938 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2998 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3044 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3045 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3046 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3050 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3149 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3200 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3292 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3297 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3901 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0727 cve-icon cve-icon
https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2 cve-icon cve-icon
https://github.com/FasterXML/jackson-databind/issues/2387 cve-icon cve-icon
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb%40%3Ccommits.pulsar.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d%40%3Cissues.iceberg.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a%40%3Ccommits.ambari.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-14379 cve-icon
https://security.netapp.com/advisory/ntap-20190814-0001/ cve-icon cve-icon
https://support.apple.com/kb/HT213189 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-14379 cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html cve-icon cve-icon
History

Thu, 08 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 26 Aug 2024 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus

Subscriptions

Apple Xcode
Debian Debian Linux
Fasterxml Jackson-databind
Fedoraproject Fedora
Netapp Active Iq Unified Manager Oncommand Workflow Automation Service Level Manager Snapcenter
Oracle Banking Platform Communications Diameter Signaling Router Communications Instant Messaging Server Financial Services Analytical Applications Infrastructure Goldengate Stream Analytics Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Primavera Gateway Primavera Unifier Retail Customer Management And Segmentation Foundation Retail Xstore Point Of Service Siebel Engineering - Installer \& Deployment Siebel Ui Framework
Redhat Amq Streams Enterprise Linux Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform Jboss Fuse Jboss Single Sign On Logging Openshift Openshift Application Runtimes Openshift Container Platform Red Hat Single Sign On Rhel Software Collections Single Sign-on
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-08T21:03:20.792Z

Reserved: 2019-07-29T00:00:00.000Z

Link: CVE-2019-14379

cve-icon Vulnrichment

Updated: 2024-08-05T00:19:40.551Z

cve-icon NVD

Status : Modified

Published: 2019-07-29T12:15:16.633

Modified: 2026-10-08T21:17:12.573

Link: CVE-2019-14379

cve-icon Redhat

Severity : Important

Publid Date: 2019-07-23T00:00:00Z

Links: CVE-2019-14379 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses