CVE-2019-16943
criticalA Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.
Vendor / product: Fasterxml — jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-10-01 17:15
Modified: 2026-10-07 21:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
fasterxml / jackson-databind ≥2.0.0 <2.6.7.3, ≥2.7.0 <2.8.11.5, ≥2.9.0 <2.9.10.1
debian / debian_linux 8.0, 9.0, 10.0
fedoraproject / fedora 30, 31
redhat / jboss_enterprise_application_platform 7.2, 7.3
oracle / banking_platform 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2
oracle / communications_billing_and_revenue_management 7.5.0.23.0, 12.0.0.3.0
oracle / communications_calendar_server 8.0.0.2.0, 8.0.0.3.0
oracle / communications_cloud_native_core_network_slice_selection_function 1.2.1
oracle / communications_evolved_communications_application_server 7.1
oracle / global_lifecycle_management_nextgen_oui_framework 12.2.1.3.0, 12.2.1.4.0, 13.9.4.2.2
oracle / goldengate_application_adapters 19.1.0.0.0
oracle / jd_edwards_enterpriseone_orchestrator 9.2
oracle / jd_edwards_enterpriseone_tools 9.2
oracle / primavera_gateway ≥17.7 ≤17.12.6, ≥18.8.0 ≤18.8.8, 16.1, 16.2, 19.12.0
oracle / retail_merchandising_system 15.0.3, 16.0.2, 16.0.3
oracle / retail_sales_audit 14.1
oracle / siebel_engineering_-_installer_\&_deployment ≤2.20.5
oracle / trace_file_analyzer 12.2.0.1, 18c, 19c
oracle / webcenter_portal 12.2.1.3.0, 12.2.1.4.0
oracle / webcenter_sites 12.2.1.3.0, 12.2.1.4.0
oracle / weblogic_server 12.2.1.3.0, 12.2.1.4.0
netapp / active_iq_unified_manager ≥7.3, ≥9.5
netapp / oncommand_api_services all versions
netapp / oncommand_workflow_automation all versions
netapp / service_level_manager all versions
netapp / steelstore_cloud_integrated_storage all versions
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/FasterXML/jackson-databind/issues/2478
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2020.html
Patch / mitigation: https://github.com/FasterXML/jackson-databind/issues/2478
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2020.html
References
- https://access.redhat.com/errata/RHSA-2020:0159 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2020:0160 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2020:0161 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2020:0164 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2020:0445 cve@mitre.org
- https://github.com/FasterXML/jackson-databind/issues/2478 cve@mitre.org
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b51... cve@mitre.org
- https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712eb... cve@mitre.org
- https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7... cve@mitre.org
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1... cve@mitre.org
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e1... cve@mitre.org
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e8... cve@mitre.org
- https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed061... cve@mitre.org
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd5... cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-kno... cve@mitre.org
- https://seclists.org/bugtraq/2019/Oct/6 cve@mitre.org
- https://security.netapp.com/advisory/ntap-20191017-0006/ cve@mitre.org
- https://www.debian.org/security/2019/dsa-4542 cve@mitre.org
- https://www.oracle.com//security-alerts/cpujul2021.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpuapr2020.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpujan2020.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpujul2020.html cve@mitre.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗