Description
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.9.3-1 | — |
| Debian 13 | jackson-databind | 2.9.9.3-1 | — |
| Debian 12 | jackson-databind | 2.9.9.3-1 | — |
| Debian 10 | jackson-databind | 2.9.8-3+deb10u1 | DSA-4542-1 |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u6 | DSA-4542-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | jackson-databind | 2.4.2-2+deb8u8 | DLA-1879-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm2 | USN-4813-1 |
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.7.el7 | RHSA-2019:2743 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 4.8.13-1.Final_redhat_00001.1.el6sso | RHSA-2019:3046, RHSA-2019:3045, RHSA-2019:3044 |
| Red Hat Single Sign On 7 | rh-sso7-libunix-dbus-java +1 | 0.8.0-2.el7sso | RHSA-2019:3045 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-1.redhat_00005.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-codehaus-jackson +4 | 1.9.13-9.redhat_00006.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-4.SP3_redhat_00002.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.16-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.11-2.SP1_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.7-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.17-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +6 | 2.9.9-1.redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.9.3-1.redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jackson-jaxrs-base +2 | 2.9.9-2.redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.23-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxrs-api_2.1_spec | 1.0.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-logging | 3.3.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.14-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.9-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-msc | 1.4.8-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.14-1.SP1_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-4.Final_redhat_00004.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.6-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.34-2.Final_redhat_00002.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-5.Final_redhat_00004.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-20.SP12_redhat_00007.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.25-1.SP1_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-2.Final_redhat_00002.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.4-1.GA_redhat_00002.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.4-1.GA_redhat_00002.1.el7eap | RHSA-2019:2936 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.6-2.Final_redhat_00001.1.el6eap | RHSA-2019:2937, RHSA-2019:2936, RHSA-2019:2935 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.9.2 | 2.9.9.2 | GHSA-6fpp-rgj9-8rwc |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.4 | 2.8.11.4 | GHSA-6fpp-rgj9-8rwc |
| Maven | com.fasterxml.jackson.core:jackson-databind | < 2.7.9.6 | 2.7.9.6 | GHSA-6fpp-rgj9-8rwc |
Advisories 14
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4813-1 jackson-databind vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- WID-SEC-2026-2754 Red Hat Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2019:3045 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:3046 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:3044 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2937 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2935 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2936 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2743 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4542-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1879-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
References
- [debian-lts-announce] 20190812 [SECURITY] [DLA 1879-1] jackson-databind security update mailing-list
- [ambari-commits] 20190813 [ambari] branch branch-2.7 updated: AMBARI-25352 : Upgrade fasterxml jackson dependency due to CVE-2019-14379 (#3066) mailing-list
- [ambari-commits] 20190813 [ambari] branch trunk updated: AMBARI-25352 : Upgrade fasterxml jackson dependency due to CVE-2019-14379(trunk) (#3067) mailing-list
- [pulsar-commits] 20190822 [GitHub] [pulsar] massakam opened a new pull request #5011: [security] Upgrade jackson-databind mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [tomee-dev] 20190905 [GitHub] [tomee] robert-schaft-hon commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [tomee-dev] 20190906 [GitHub] [tomee] rzo1 commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [struts-dev] 20190908 Build failed in Jenkins: Struts-master-JDK8-dependency-check #204 mailing-list
- [tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- [tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439 mailing-list
- RHSA-2019:2743 vendor-advisory
- FEDORA-2019-99ff6aa32c vendor-advisory
- FEDORA-2019-ae6a703b8f vendor-advisory
- FEDORA-2019-fb23eccc03 vendor-advisory
- [tinkerpop-commits] 20190924 [GitHub] [tinkerpop] justinchuch opened a new pull request #1200: Upgrade jackson due to CVE issues mailing-list
- RHSA-2019:2858 vendor-advisory
- RHSA-2019:2937 vendor-advisory
- RHSA-2019:2935 vendor-advisory
- RHSA-2019:2936 vendor-advisory
- RHSA-2019:2938 vendor-advisory
- RHSA-2019:2998 vendor-advisory
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] rdblue opened a new pull request #533: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] mccheah opened a new pull request #535: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] rdblue commented on issue #535: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] mccheah commented on issue #535: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] rdblue closed pull request #533: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] rdblue merged pull request #535: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- [iceberg-issues] 20191010 [GitHub] [incubator-iceberg] rdblue commented on issue #533: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- RHBA-2019:2824 vendor-advisory
- RHSA-2019:3044 vendor-advisory
- RHSA-2019:3045 vendor-advisory
- RHSA-2019:3050 vendor-advisory
- RHSA-2019:3046 vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- RHSA-2019:3149 vendor-advisory
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- RHSA-2019:3200 vendor-advisory
- [iceberg-issues] 20191027 [GitHub] [incubator-iceberg] rdsr commented on issue #535: Update Jackson to 2.9.10 for CVE-2019-14379 mailing-list
- RHSA-2019:3292 vendor-advisory
- RHSA-2019:3297 vendor-advisory
- RHSA-2019:3901 vendor-advisory
- RHSA-2020:0727 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://github.com/FasterXML/jackson-databind/issues/2387
- https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2
- https://security.netapp.com/advisory/ntap-20190814-0001/
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://support.apple.com/kb/HT213189
- 20220314 APPLE-SA-2022-03-14-7 Xcode 13.3 mailing-list