Strix
26.1K

CVE-2019-16942

CRITICALCVSS 9.8/10EPSS 5.68%

Last modified

CVE-2019-16942 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. EPSS estimates a 5.68% chance of exploitation in the next 30 days.

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
5.68%

92.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
FasterxmlJackson-Databind>= 2.0.0, < 2.6.7.3
FasterxmlJackson-Databind>= 2.8.0, < 2.8.11.5
FasterxmlJackson-Databind>= 2.9.0, < 2.9.10.1
DebianDebian Linux8.0
DebianDebian Linux9.0
DebianDebian Linux10.0
FedoraprojectFedora30
FedoraprojectFedora31
RedhatJboss Enterprise Application Platform7.2.0
RedhatJboss Enterprise Application Platform7.3
NetappActive Iq Unified Manager>= 7.3
NetappActive Iq Unified Manager>= 9.5
NetappOncommand Api ServicesAll versions
NetappOncommand Workflow AutomationAll versions
NetappService Level ManagerAll versions
NetappSteelstore Cloud Integrated StorageAll versions
OracleBanking Platform2.4.0
OracleBanking Platform2.4.1
OracleBanking Platform2.5.0
OracleBanking Platform2.6.0
OracleBanking Platform2.6.1
OracleBanking Platform2.6.2
OracleBanking Platform2.7.0
OracleBanking Platform2.7.1
OracleBanking Platform2.9.0
OracleCommunications Billing And Revenue Management7.5.0.23.0
OracleCommunications Billing And Revenue Management12.0.0.3.0
OracleCommunications Calendar Server8.0.0.2.0
OracleCommunications Calendar Server8.0.0.3.0
OracleCommunications Cloud Native Core Network Slice Selection Function1.2.1
OracleCommunications Evolved Communications Application Server7.1
OracleDatabase Server12.2.0.1
OracleDatabase Server18c
OracleDatabase Server19c
OracleGlobal Lifecycle Management Nextgen Oui Framework12.2.1.3.0
OracleGlobal Lifecycle Management Nextgen Oui Framework12.2.1.4.0
OracleGlobal Lifecycle Management Nextgen Oui Framework13.9.4.2.2
OracleGoldengate Application Adapters19.1.0.0.0
OracleJd Edwards Enterpriseone Orchestrator9.2
OracleJd Edwards Enterpriseone Tools9.2
OraclePrimavera Gateway>= 17.12.0, <= 17.12.6
OraclePrimavera Gateway>= 18.8.0, <= 18.8.8
OraclePrimavera Gateway19.12.0
OraclePrimavera Unifier>= 17.7, <= 17.12
OraclePrimavera Unifier16.1
OraclePrimavera Unifier16.2
OraclePrimavera Unifier18.8
OraclePrimavera Unifier19.12
OracleRetail Merchandising System15.0.3
OracleRetail Merchandising System16.0.2

Showing 50 of 61 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-16942?
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
How severe is CVE-2019-16942?
CVE-2019-16942 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 5.68% probability of exploitation in the next 30 days.
How do I fix CVE-2019-16942?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2019

View all 2019CVEs →

Are you affected by CVE-2019-16942?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST