● CVE — Critical
CVE-2019-16942
Vendorredhat, debian, fedoraproject, fasterxml, oracleProductjboss enterprise application platform, debian linux, fedora, jackson-databind, database server, active iq unified manager, oncommand workflow automation, primavera unifier, jd edwards enterpriseone tools, retail merchandising system, banking platform, steelstore cloud integrated storage, communications billing and revenue management, oncommand api services, service level manager, goldengate application adapters, primavera gateway, siebel ui framework, retail sales audit, jd edwards enterpriseone orchestrator, siebel engineering - installer & deployment, communications evolved communications application server, communications calendar server, communications cloud native core network slice selection function, global lifecycle management nextgen oui frameworkDiscoveredOct 1, 2019UpdatedNov 21, 2024
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.