Vulnerability Description
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fasterxml | Jackson-Databind | >= 2.0.0, < 2.6.7.3 |
| Fedoraproject | Fedora | 30 |
| Debian | Debian Linux | 8.0 |
| Netapp | Oncommand Api Services | - |
| Netapp | Oncommand Workflow Automation | - |
| Netapp | Steelstore Cloud Integrated Storage | - |
| Redhat | Jboss Enterprise Application Platform | 7.2 |
| Redhat | Enterprise Linux | 6.0 |
| Oracle | Banking Platform | 2.4.0 |
| Oracle | Customer Management And Segmentation Foundation | 18.0 |
| Oracle | Financial Services Analytical Applications Infrastructure | >= 8.0.2, <= 8.0.8 |
| Oracle | Global Lifecycle Management Opatch | < 11.2.0.3.23 |
| Oracle | Goldengate Application Adapters | 19.1.0.0.0 |
| Oracle | Goldengate Stream Analytics | < 19.1.0.0.1 |
| Oracle | Primavera Gateway | >= 17.7, <= 17.12 |
| Oracle | Retail Customer Management And Segmentation Foundation | 17.0 |
| Oracle | Retail Xstore Point Of Service | 7.1 |
| Oracle | Weblogic Server | 12.2.1.3.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2019:3200Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0159Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0160Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0161Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0164Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0445Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/2449PatchThird Party Advisory
- https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3ae
- https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df2
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e
- https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75
- https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12e
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551
FAQ
What is CVE-2019-16335?
CVE-2019-16335 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
How severe is CVE-2019-16335?
CVE-2019-16335 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-16335?
Check the references section above for vendor advisories and patch information. Affected products include: Fasterxml Jackson-Databind, Fedoraproject Fedora, Debian Debian Linux, Netapp Oncommand Api Services, Netapp Oncommand Workflow Automation.