CVE: 2019-14439 found in jackson-databind - Version: 2.4.2 [JAVA]

[github-actions[bot]]

Veracode Software Composition Analysis

Attribute	Details
Library	jackson-databind
Description	General data-binding functionality for Jackson: works on core streaming API
Language	JAVA
Vulnerability	Deserialization Of Untrusted Data
Vulnerability description	jackson-databind is vulnerable to deserialization of untrusted data. A Polymorphic Typing issue existed in the library as DefaultTransactionManagerLookup and JNDIConnectionSource was missing from the validator function.. This only occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and it can potentially lead to remote code execution.
CVE	2019-14439
CVSS score	5
Vulnerability present in version/s	2.0.0-rc1-2.6.7.1
Found library version/s	2.4.2
Vulnerability fixed in version	2.9.9.2
Library latest version	2.16.1
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/908?version=2.4.2
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/20935
• Patch: https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b

[github-actions[bot]]

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/2

[github-actions[bot]]

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/43