FlawAtlas
Search the atlas
CVE-2019-14379 Critical

CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Exploit probability 8.1%
Published July 29, 2019
Required by Not available
Last source change August 7, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

77 explicit affected versions

Maven com.fasterxml.jackson.core:jackson-databind

117 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities GHSA-6fpp-rgj9-8rwc

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

View original source
Open Source Vulnerabilities CVE-2019-14379

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

View original source

05 / REFERENCES

Further evidence