CVE-2019-10172 — Improper Restriction of XML External Entity Reference in jackson-mapper-asl

Description

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

Affected products

Vendor	Product	Affected	Fixed
Redhat	jackson-mapper-asl	1.9.x	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libjackson-json-java	1.9.13-2	—
Debian 13	libjackson-json-java	1.9.13-2	—
Debian 12	libjackson-json-java	1.9.13-2	—
Debian 9	libjackson-json-java	1.9.2-8+deb9u1	DLA-2342-1
Debian 8	libjackson-json-java	1.9.2-3+deb8u1	DLA-2091-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	libjackson-json-java	No fix yet	—
Ubuntu 18.04 LTS	libjackson-json-java	No fix yet	—
Ubuntu 16.04 LTS	libjackson-json-java	1.9.2-7ubuntu0.2	USN-4741-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 14.04 LTS	libjackson-json-java	1.9.2-3+deb8u1build0.14.04.1~esm1	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.9.0-4.redhat_00010.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.2.12-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-bouncycastle +3	1.60.0-2.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-codehaus-jackson +4	1.9.13-10.redhat_00007.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-cryptacular	1.2.4-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.6.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-glassfish-el +1	3.0.1-5.b08_redhat_00004.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-glassfish-javamail	1.6.2-2.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-10.SP3_redhat_00008.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-hal-console	3.0.21-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.16-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-hibernate-commons-annotations	5.0.5-1.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-hibernate-search +5	5.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-httpcomponents-client	4.5.4-1.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-httpcomponents-core	4.4.5-1.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.18-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.2-2.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jaegertracing-jaeger-client-java +2	0.34.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jakarta-el	3.0.3-1.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jandex	2.1.2-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jasypt	1.9.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-javaee-security-soteria +1	1.0.0-3.redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jaxbintros	1.0.3-1.GA_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-classfilewriter	1.2.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-common-beans	2.0.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-ejb-api_3.2_spec +1	1.0.2-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.31-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-invocation	1.5.2-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-5.SP2_redhat_00003.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.9-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-openjdk-orb	8.1.4-3.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.18-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-remoting-jmx	3.0.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-security-negotiation	3.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-10.Final_redhat_00011.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-5.Final_redhat_00006.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-threads	2.3.3-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-vfs	3.2.15-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-websocket-api_1.1_spec	1.1.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-weld-3.1-api +2	3.1.0-6.SP2_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jbossws-common	3.2.3-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jgroups	4.0.20-2.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jgroups-azure	1.2.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jgroups-kubernetes	1.0.13-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-microprofile-config +1	1.4.0-1.redhat_00003.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-health	2.2.0-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-metrics +1	2.3.0-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-opentracing +1	1.3.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-rest-client +1	1.4.0-1.redhat_00004.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-mod_cluster	1.4.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-narayana +10	5.9.8-1.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-opensaml +13	3.3.1-1.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-picketbox +1	5.0.3-7.Final_redhat_00006.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-picketlink-bindings +1	2.5.5-23.SP12_redhat_00012.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-9.SP8_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-slf4j-jboss-logmanager	1.0.4-1.GA_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-config	1.3.6-1.SP01_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-health	1.0.2-2.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-metrics	2.4.0-1.redhat_00004.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-opentracing	1.3.4-1.redhat_00004.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-snakeyaml	1.24.0-2.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-stax2-api	4.2.0-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-sun-istack-commons +2	3.0.10-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-txw2 +8	2.3.3-4.b02_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-2.SP2_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-weld-cdi-2.0-api	2.0.0-4.SP1_redhat_00004.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.1.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.8-3.GA_redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.8-3.GA_redhat_00002.1.el7eap	RHSA-2020:2512, RHSA-2020:2059
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.12-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-woodstox-core	6.0.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-ws-commons-XmlSchema	2.2.4-1.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-wss4j +6	2.2.5-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	spark-4.0-scala-2.13	4.0.5-r1	—
Wolfi rolling	tez	No fix yet	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

rusakovichma/CVE-2019-10172 ★ 1 · Oct 14, 2020

CVE-2019-10172 PoC and Possible mitigations

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.codehaus.jackson:jackson-mapper-asl	<= 1.9.13	—	GHSA-r6j9-8759-g62w

Advisories 15

RHSA-2020:2512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:2513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:2511 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2025-2123 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
RHSA-2020:2059 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:2060 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:2058 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-4741-1 libjackson-json-java vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DLA-2342-1 libjackson-json-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2091-1 libjackson-json-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
WID-SEC-2025-0802 Atlassian Confluence Data Center und Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
NCSC-2024-0413 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Oct 17, 2024
WID-SEC-2024-3197 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024

CNA	v3.0	5.9
OSV:GHSA	v3.1	7.5

Improper Restriction of XML External Entity Reference in jackson-mapper-asl

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

Wolfi

Public exploits

GitHub 1 repository

Affected packages

Advisories 15

References