Zafiyetler / CVE-2019-14540

kritik

CVE-2019-14540

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig

Yayın Değişiklik CWE 502
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (orta), AlmaLinux (orta), Oracle (orta), Rocky Linux (orta), Ubuntu (orta).

Açıklama

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
maven::GitHub Security Advisory Mavencom.fasterxml.jackson.core:jackson-databind2.9.10, 2.8.11.5, 2.6.7.3
alma 8pki-deps:10.6::apache-commons-collections, pki-deps:10.6::apache-commons-lang, pki-deps:10.6::bea-stax-api ve 25 tane daha3.2.2-10.module_el8.5.0+2577+9e95fe00 ve 20 tane daha
chainguardmysql-8.08.0.38-r0
debian 10jackson-databind2.9.8-3+deb10u1
debian 11jackson-databind2.10.0-1
debian 12jackson-databind2.10.0-1
debian 13jackson-databind2.10.0-1
debian 14jackson-databind2.10.0-1
debian 8jackson-databind2.4.2-2+deb8u9
debian 9jackson-databind2.8.6-1+deb9u6
echojackson-databind2.10.0-1
Oracle Linux 8apache-commons-collections, apache-commons-lang, bea-stax-api ve 43 tane daha3.2.2-10.module+el8.2.0+5508+146760da ve 27 tane daha
15 kaynaktaki 122 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
maven::GitHub Security Advisory Mavencom.fasterxml.jackson.core:jackson-databind2.9.10, 2.8.11.5, 2.6.7.3
alma 8pki-deps:10.6::apache-commons-collections3.2.2-10.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::apache-commons-lang2.6-21.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::bea-stax-api1.2.0-16.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::glassfish-fastinfoset1.2.13-9.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::glassfish-jaxb-api2.2.12-8.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::glassfish-jaxb-core2.2.11-11.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::glassfish-jaxb-runtime2.2.11-11.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::glassfish-jaxb-txw22.2.11-11.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jackson-annotations2.10.0-1.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jackson-core2.10.0-1.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jackson-databind2.10.0-1.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jackson-jaxrs-json-provider2.9.9-1.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jackson-jaxrs-providers2.9.9-1.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jackson-module-jaxb-annotations2.7.6-4.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::jakarta-commons-httpclient1:3.1-28.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::javassist3.18.1-8.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::javassist-javadoc3.18.1-8.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::relaxngDatatype2011.1-7.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::slf4j1.7.25-4.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::slf4j-jdk141.7.25-4.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::stax-ex1.7.7-8.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::velocity1.7-24.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::xalan-j22.7.1-38.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::xerces-j22.11.0-34.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::xml-commons-apis1.4.01-25.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::xml-commons-resolver1.2-26.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::xmlstreambuffer1.5.4-8.module_el8.5.0+2577+9e95fe00
alma 8pki-deps:10.6::xsom0-19.20110809svn.module_el8.5.0+2577+9e95fe00
chainguardmysql-8.08.0.38-r0
debian 10jackson-databind2.9.8-3+deb10u1
debian 11jackson-databind2.10.0-1
debian 12jackson-databind2.10.0-1
debian 13jackson-databind2.10.0-1
debian 14jackson-databind2.10.0-1
debian 8jackson-databind2.4.2-2+deb8u9
debian 9jackson-databind2.8.6-1+deb9u6
echojackson-databind2.10.0-1
Oracle Linux 8apache-commons-collections3.2.2-10.module+el8.2.0+5508+146760da
Oracle Linux 8apache-commons-lang2.6-21.module+el8.2.0+5508+146760da
Oracle Linux 8bea-stax-api1.2.0-16.module+el8.2.0+5508+146760da
Oracle Linux 8glassfish-fastinfoset1.2.13-9.module+el8.2.0+5508+146760da
Oracle Linux 8glassfish-jaxb-api2.2.12-8.module+el8.2.0+5508+146760da
Oracle Linux 8glassfish-jaxb-core2.2.11-11.module+el8.2.0+5508+146760da
Oracle Linux 8glassfish-jaxb-runtime2.2.11-11.module+el8.2.0+5508+146760da
Oracle Linux 8glassfish-jaxb-txw22.2.11-11.module+el8.2.0+5508+146760da
Oracle Linux 8jackson-annotations2.10.0-1.module+el8.2.0+5508+146760da
Oracle Linux 8jackson-core2.10.0-1.module+el8.2.0+5508+146760da
Oracle Linux 8jackson-databind2.10.0-1.module+el8.2.0+5508+146760da
Oracle Linux 8jackson-jaxrs-json-provider2.9.9-1.module+el8.2.0+5508+146760da
Oracle Linux 8jackson-jaxrs-providers2.9.9-1.module+el8.2.0+5508+146760da
Oracle Linux 8jackson-module-jaxb-annotations2.7.6-4.module+el8.2.0+5508+146760da
Oracle Linux 8jakarta-commons-httpclient1:3.1-28.module+el8.2.0+5508+146760da
Oracle Linux 8javassist3.18.1-8.module+el8.2.0+5508+146760da
Oracle Linux 8javassist-javadoc3.18.1-8.module+el8.2.0+5508+146760da
Oracle Linux 8jss4.6.2-4.module+el8.2.0+5594+09d37207
Oracle Linux 8jss-javadoc4.6.2-4.module+el8.2.0+5594+09d37207
Oracle Linux 8ldapjdk4.21.0-2.module+el8.2.0+5594+09d37207
Oracle Linux 8ldapjdk-javadoc4.21.0-2.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-base10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-base-java10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-ca10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-kra10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-server10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-servlet-4.0-api1:9.0.7-16.module+el8.2.0+5508+146760da
Oracle Linux 8pki-servlet-engine1:9.0.7-16.module+el8.2.0+5508+146760da
Oracle Linux 8pki-symkey10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8pki-tools10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8python-nss-doc1.0.1-10.module+el8.2.0+5508+146760da
Oracle Linux 8python3-nss1.0.1-10.module+el8.2.0+5508+146760da
Oracle Linux 8python3-pki10.8.3-1.0.1.module+el8.2.0+5594+09d37207
Oracle Linux 8relaxngDatatype2011.1-7.module+el8.2.0+5508+146760da
Oracle Linux 8resteasy3.0.26-3.module+el8.2.0+5508+146760da
Oracle Linux 8slf4j1.7.25-4.module+el8.2.0+5508+146760da
Oracle Linux 8slf4j-jdk141.7.25-4.module+el8.2.0+5508+146760da
Oracle Linux 8stax-ex1.7.7-8.module+el8.2.0+5508+146760da
Oracle Linux 8tomcatjss7.4.1-2.module+el8.2.0+5594+09d37207
Oracle Linux 8velocity1.7-24.module+el8.2.0+5508+146760da
Oracle Linux 8xalan-j22.7.1-38.module+el8.2.0+5508+146760da
Oracle Linux 8xerces-j22.11.0-34.module+el8.2.0+5508+146760da
Oracle Linux 8xml-commons-apis1.4.01-25.module+el8.2.0+5508+146760da
Oracle Linux 8xml-commons-resolver1.2-26.module+el8.2.0+5508+146760da
Oracle Linux 8xmlstreambuffer1.5.4-8.module+el8.2.0+5508+146760da
Oracle Linux 8xsom0-19.20110809svn.module+el8.2.0+5508+146760da
Red Hatelasticsearch-cloud-kubernetesdüzeltme belirtilmemiş
Red Hatopendaylightdüzeltme belirtilmemiş
Red Hatopenshift-elasticsearch-plugindüzeltme belirtilmemiş
Red Hatrh-maven35-jackson-databinddüzeltme belirtilmemiş
Red Hatrh-maven35-jackson-databind-javadocdüzeltme belirtilmemiş
rocky 8maven:3.5::slf4j1.7.25-4.module+el8.3.0+133+b8b54b58
rocky 8pki-deps:10.6::apache-commons-collections3.2.2-10.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::apache-commons-lang2.6-21.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::bea-stax-api1.2.0-16.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::glassfish-fastinfoset1.2.13-9.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::glassfish-jaxb-api2.2.12-8.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::glassfish-jaxb-core2.2.11-11.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::glassfish-jaxb-runtime2.2.11-11.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::glassfish-jaxb-txw22.2.11-11.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jackson-annotations2.10.0-1.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jackson-core2.10.0-1.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jackson-databind2.10.0-1.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jackson-jaxrs-json-provider2.9.9-1.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jackson-jaxrs-providers2.9.9-1.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jackson-module-jaxb-annotations2.7.6-4.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::jakarta-commons-httpclient1:3.1-28.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::javassist3.18.1-8.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::javassist-javadoc3.18.1-8.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::python-nss-doc1.0.1-10.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::python3-nss1.0.1-10.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::relaxngDatatype2011.1-7.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::resteasy3.0.26-3.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::slf4j1.7.25-4.module+el8.5.0+697+f586bb30
rocky 8pki-deps:10.6::slf4j-jdk141.7.25-4.module+el8.5.0+697+f586bb30
rocky 8pki-deps:10.6::stax-ex1.7.7-8.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::velocity1.7-24.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::xalan-j22.7.1-38.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::xerces-j22.11.0-34.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::xml-commons-apis1.4.01-25.module+el8.5.0+697+f586bb30
rocky 8pki-deps:10.6::xml-commons-resolver1.2-26.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::xmlstreambuffer1.5.4-8.module+el8.3.0+53+ea062990
rocky 8pki-deps:10.6::xsom0-19.20110809svn.module+el8.3.0+53+ea062990
ubuntu 16.04-ESMjackson-databind2.4.2-3ubuntu0.1~esm2

Referanslar

109 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.