Description
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | jackson-databind | 2.9.10, 2.10.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.10.0-1 | — |
| Debian 13 | jackson-databind | 2.10.0-1 | — |
| Debian 12 | jackson-databind | 2.10.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | jackson-databind | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | jackson-databind | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.11-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-6.SP3_redhat_00004.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.14-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.9.10-1.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.1-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.9.10-2.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.27-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-7.Final_redhat_00007.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.42-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-21.SP12_redhat_00010.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.28-2.SP1_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-3.Final_redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.6-5.GA_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.18-2.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.6-5.GA_redhat_00001.1.el7eap | RHSA-2020:0160 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.10 | 2.9.10 | GHSA-qmqc-x3r4-6v39 |
Advisories 4
- RHSA-2020:0160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
References
- RHSA-2020:0729 vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14893
- https://github.com/FasterXML/jackson-databind/issues/2469
- https://security.netapp.com/advisory/ntap-20200327-0006/
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html