CVE-2019-14892

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.9.10 jackson-databind versions prior to 2.8.11.5 jackson-databind versions prior to 2.6.7.3

Description The issue is related to the restoration of untrusted data in memory, which can allow a remote attacker to execute arbitrary code. This is due to a flaw in jackson-databind that permits polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes.

Recommendations For versions prior to 2.9.10, update to version 2.9.10 or later. For versions prior to 2.8.11.5, update to version 2.8.11.5 or later. For versions prior to 2.6.7.3, update to version 2.6.7.3 or later. As a temporary workaround, consider restricting the use of commons-configuration 1 and 2 JNDI classes to minimize the risk of exploitation.