2019-06-13 23:00:46 +00:00
{
2019-10-16 18:01:37 +00:00
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org" ,
"ID" : "CVE-2019-12814" ,
"STATE" : "PUBLIC"
2019-06-13 23:00:46 +00:00
} ,
2019-10-16 18:01:37 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
2019-06-19 14:00:50 +00:00
{
2019-10-16 18:01:37 +00:00
"product" : {
"product_data" : [
2019-06-19 14:00:50 +00:00
{
2019-10-16 18:01:37 +00:00
"product_name" : "n/a" ,
"version" : {
"version_data" : [
2019-06-19 14:00:50 +00:00
{
2019-10-16 18:01:37 +00:00
"version_value" : "n/a"
2019-06-19 14:00:50 +00:00
}
]
}
}
]
} ,
2019-10-16 18:01:37 +00:00
"vendor_name" : "n/a"
2019-06-19 14:00:50 +00:00
}
]
}
} ,
2019-10-16 18:01:37 +00:00
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
"value" : "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server."
2019-06-19 14:00:50 +00:00
}
]
} ,
2019-10-16 18:01:37 +00:00
"problemtype" : {
"problemtype_data" : [
2019-06-19 14:00:50 +00:00
{
2019-10-16 18:01:37 +00:00
"description" : [
2019-06-19 14:00:50 +00:00
{
2019-10-16 18:01:37 +00:00
"lang" : "eng" ,
"value" : "n/a"
2019-06-19 14:00:50 +00:00
}
]
}
]
} ,
2019-10-16 18:01:37 +00:00
"references" : {
"reference_data" : [
2019-06-19 14:00:50 +00:00
{
2019-10-16 18:01:37 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://github.com/FasterXML/jackson-databind/issues/2341" ,
"url" : "https://github.com/FasterXML/jackson-databind/issues/2341"
2019-06-21 17:00:45 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[debian-lts-announce] 20190621 [SECURITY] [DLA 1831-1] jackson-databind security update" ,
"url" : "https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html"
2019-06-23 22:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20190623 [GitHub] [zookeeper] eolivelli opened a new pull request #1001: ZOOKEEPER-3441 OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0@%3Cnotifications.zookeeper.apache.org%3E"
2019-06-23 22:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190623 [jira] [Updated] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957@%3Cissues.zookeeper.apache.org%3E"
2019-06-23 22:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190623 [jira] [Created] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1@%3Cissues.zookeeper.apache.org%3E"
2019-06-23 22:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-dev] 20190623 [jira] [Created] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731@%3Cdev.zookeeper.apache.org%3E"
2019-06-24 21:00:47 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20190624 [GitHub] [zookeeper] eolivelli closed pull request #1001: ZOOKEEPER-3441 OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324@%3Cnotifications.zookeeper.apache.org%3E"
2019-06-24 21:00:47 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20190624 [GitHub] [zookeeper] phunt commented on a change in pull request #1001: ZOOKEEPER-3441 OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682@%3Cnotifications.zookeeper.apache.org%3E"
2019-06-24 21:00:47 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20190624 [GitHub] [zookeeper] eolivelli commented on issue #1001: ZOOKEEPER-3441 OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4@%3Cnotifications.zookeeper.apache.org%3E"
2019-06-25 10:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "CONFIRM" ,
"name" : "https://security.netapp.com/advisory/ntap-20190625-0006/" ,
"url" : "https://security.netapp.com/advisory/ntap-20190625-0006/"
2019-07-08 19:00:48 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190708 [jira] [Commented] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f@%3Cissues.zookeeper.apache.org%3E"
2019-07-11 06:00:53 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20190710 [GitHub] [zookeeper] phunt closed pull request #1013: ZOOKEEPER-3441: OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2@%3Cnotifications.zookeeper.apache.org%3E"
2019-07-11 06:00:53 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20190710 [GitHub] [zookeeper] phunt opened a new pull request #1013: ZOOKEEPER-3441: OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87@%3Cnotifications.zookeeper.apache.org%3E"
2019-07-12 07:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190712 [jira] [Assigned] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3@%3Cissues.zookeeper.apache.org%3E"
2019-07-12 07:00:46 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190712 [jira] [Resolved] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c@%3Cissues.zookeeper.apache.org%3E"
2019-07-12 09:00:48 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190712 [jira] [Commented] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560@%3Cissues.zookeeper.apache.org%3E"
2019-07-13 12:00:54 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20190713 [jira] [Updated] (ZOOKEEPER-3441) OWASP is flagging jackson-databind-2.9.9.jar for CVE-2019-12814" ,
"url" : "https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209@%3Cissues.zookeeper.apache.org%3E"
2019-07-16 13:25:12 -07:00
} ,
2019-07-23 23:01:24 +00:00
{
2019-10-16 18:01:37 +00:00
"url" : "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
2019-07-23 23:01:24 +00:00
} ,
2019-07-16 13:25:12 -07:00
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[accumulo-commits] 20190723 [accumulo] branch 2.0 updated: Fix CVE-2019-12814 Use jackson-databind 2.9.9.1" ,
"url" : "https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd@%3Ccommits.accumulo.apache.org%3E"
2019-09-05 14:00:59 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E"
2019-09-05 14:00:59 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190905 [GitHub] [tomee] asf-ci commented on issue #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E"
2019-09-05 14:00:59 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E"
2019-09-05 14:00:59 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190905 [GitHub] [tomee] rzo1 opened a new pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E"
2019-09-05 15:01:04 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190905 [GitHub] [tomee] robert-schaft-hon commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E"
2019-09-06 10:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190906 [GitHub] [tomee] rzo1 commented on issue #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E"
2019-09-08 11:00:59 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[struts-dev] 20190908 Build failed in Jenkins: Struts-master-JDK8-dependency-check #204" ,
"url" : "https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E"
2019-09-10 03:00:51 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #549: [TOMEE-2655] [7.1.x] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E"
2019-09-10 03:00:51 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[tomee-dev] 20190909 [GitHub] [tomee] jgallimore merged pull request #548: [TOMEE-2655] Updates jackson-databind to 2.9.9.3 to mitigate CVE-2019-12384, CVE-2019-12814, CVE-2019-14379 and CVE-2019-14439" ,
"url" : "https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E"
2019-09-18 02:00:55 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-99ff6aa32c" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/"
2019-09-19 23:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[cassandra-commits] 20190919 [jira] [Created] (CASSANDRA-15328) Bump jackson version to >= 2.9.9.3 to address security vulnerabilities" ,
"url" : "https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E"
2019-09-22 04:00:55 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-ae6a703b8f" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/"
2019-09-22 05:00:52 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "FEDORA" ,
"name" : "FEDORA-2019-fb23eccc03" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/"
2019-09-27 03:01:03 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2858" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2858"
2019-10-01 02:01:01 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2937" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2937"
2019-10-01 02:01:01 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2935" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2935"
2019-10-01 02:01:01 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2936" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2936"
2019-10-01 02:01:01 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:2938" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:2938"
2019-10-07 20:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "MLIST" ,
"name" : "[geode-notifications] 20191007 [GitHub] [geode] jmelchio commented on issue #4102: Fix for GEODE-7255: Pickup Jackson CVE fix" ,
"url" : "https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E"
2019-10-14 21:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3044" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3044"
2019-10-14 21:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3045" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3045"
2019-10-14 21:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3050" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3050"
2019-10-14 21:00:57 +00:00
} ,
{
2019-10-16 18:01:37 +00:00
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3046" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3046"
2019-10-15 13:33:48 -07:00
} ,
{
2019-10-16 18:01:37 +00:00
"url" : "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" ,
"refsource" : "MISC" ,
"name" : "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
2019-10-17 22:01:04 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities" ,
"url" : "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E"
2019-10-18 22:01:00 +00:00
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3149" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3149"
2019-10-21 15:59:19 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities" ,
"url" : "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities" ,
"url" : "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E"
2019-10-31 21:01:12 +00:00
} ,
2019-11-01 04:01:04 +00:00
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3200" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3200"
} ,
2019-10-31 21:01:12 +00:00
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3292" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3292"
2019-10-31 22:01:14 +00:00
} ,
{
"refsource" : "REDHAT" ,
"name" : "RHSA-2019:3297" ,
"url" : "https://access.redhat.com/errata/RHSA-2019:3297"
2019-06-13 23:00:46 +00:00
}
]
}
}
