Vulnerability Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fasterxml | Jackson-Databind | >= 2.0.0, < 2.6.7.3 |
| Netapp | Oncommand Api Services | - |
| Netapp | Oncommand Workflow Automation | - |
| Netapp | Steelstore Cloud Integrated Storage | - |
| Fedoraproject | Fedora | 30 |
| Debian | Debian Linux | 8.0 |
| Redhat | Jboss Enterprise Application Platform | 7.2 |
| Redhat | Enterprise Linux | 6.0 |
| Oracle | Banking Platform | 2.4.0 |
| Oracle | Customer Management And Segmentation Foundation | 18.0 |
| Oracle | Financial Services Analytical Applications Infrastructure | >= 8.0.2, <= 8.0.8 |
| Oracle | Global Lifecycle Management Opatch | < 11.2.0.3.23 |
| Oracle | Goldengate Application Adapters | 19.1.0.0.0 |
| Oracle | Goldengate Stream Analytics | < 19.1.0.0.1 |
| Oracle | Mysql | >= 5.7.0, <= 5.7.30 |
| Oracle | Primavera Gateway | 15.2 |
| Oracle | Primavera Unifier | >= 17.7, <= 17.12 |
| Oracle | Retail Customer Management And Segmentation Foundation | 17.0 |
| Oracle | Retail Xstore Point Of Service | 7.1 |
| Oracle | Weblogic Server | 12.2.1.3.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2019:3200Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0159Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0160Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0161Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0164Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0445Third Party Advisory
- https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-Release NotesThird Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2410PatchThird Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2449PatchThird Party Advisory
- https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3ae
- https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df2
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e
- https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75
- https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5
- https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a
FAQ
What is CVE-2019-14540?
CVE-2019-14540 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
How severe is CVE-2019-14540?
CVE-2019-14540 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-14540?
Check the references section above for vendor advisories and patch information. Affected products include: Fasterxml Jackson-Databind, Netapp Oncommand Api Services, Netapp Oncommand Workflow Automation, Netapp Steelstore Cloud Integrated Storage, Fedoraproject Fedora.