{
    "id": "CVE-2019-17531",
    "published": "2019-10-12 21:15:08",
    "last_modified": "2026-06-17 02:24:04",
    "cvss_score": "9.8",
    "cvss_severity": "CRITICAL",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "cwe": "CWE-502",
    "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.",
    "epss_score": "0.05373",
    "epss_percentile": "0.92445",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 0,
    "updated_at": "2026-10-07 18:17:20",
    "priority": {
        "rank": 3,
        "label": "In your normal cycle",
        "why": "Critical by CVSS (9.8), but no sign of active exploitation."
    },
    "products": [
        {
            "vendor": "debian",
            "product": "debian_linux"
        },
        {
            "vendor": "fasterxml",
            "product": "jackson-databind"
        },
        {
            "vendor": "netapp",
            "product": "oncommand_workflow_automation"
        },
        {
            "vendor": "netapp",
            "product": "steelstore_cloud_integrated_storage"
        },
        {
            "vendor": "oracle",
            "product": "banking_platform"
        },
        {
            "vendor": "oracle",
            "product": "communications_billing_and_revenue_management"
        },
        {
            "vendor": "oracle",
            "product": "communications_calendar_server"
        },
        {
            "vendor": "oracle",
            "product": "communications_cloud_native_core_network_slice_selection_function"
        },
        {
            "vendor": "oracle",
            "product": "communications_evolved_communications_application_server"
        },
        {
            "vendor": "oracle",
            "product": "global_lifecycle_management_nextgen_oui_framework"
        },
        {
            "vendor": "oracle",
            "product": "goldengate_application_adapters"
        },
        {
            "vendor": "oracle",
            "product": "jd_edwards_enterpriseone_orchestrator"
        },
        {
            "vendor": "oracle",
            "product": "jd_edwards_enterpriseone_tools"
        },
        {
            "vendor": "oracle",
            "product": "primavera_gateway"
        },
        {
            "vendor": "oracle",
            "product": "retail_merchandising_system"
        },
        {
            "vendor": "oracle",
            "product": "retail_sales_audit"
        },
        {
            "vendor": "oracle",
            "product": "siebel_engineering_-_installer_\\&_deployment"
        },
        {
            "vendor": "oracle",
            "product": "trace_file_analyzer"
        },
        {
            "vendor": "oracle",
            "product": "webcenter_portal"
        },
        {
            "vendor": "oracle",
            "product": "webcenter_sites"
        },
        {
            "vendor": "oracle",
            "product": "weblogic_server"
        },
        {
            "vendor": "redhat",
            "product": "enterprise_linux_server"
        },
        {
            "vendor": "redhat",
            "product": "jboss_enterprise_application_platform"
        }
    ],
    "kev_detail": null,
    "exploits": [],
    "refs_list": [
        "https://access.redhat.com/errata/RHSA-2019:4192",
        "https://access.redhat.com/errata/RHSA-2020:0159",
        "https://access.redhat.com/errata/RHSA-2020:0160",
        "https://access.redhat.com/errata/RHSA-2020:0161",
        "https://access.redhat.com/errata/RHSA-2020:0164",
        "https://access.redhat.com/errata/RHSA-2020:0445",
        "https://github.com/FasterXML/jackson-databind/issues/2498",
        "https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E",
        "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
        "https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html",
        "https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062",
        "https://security.netapp.com/advisory/ntap-20191024-0005/",
        "https://www.oracle.com//security-alerts/cpujul2021.html",
        "https://www.oracle.com/security-alerts/cpuapr2020.html",
        "https://www.oracle.com/security-alerts/cpujan2020.html",
        "https://www.oracle.com/security-alerts/cpujul2020.html",
        "https://www.oracle.com/security-alerts/cpuoct2020.html",
        "https://access.redhat.com/errata/RHSA-2019:4192",
        "https://access.redhat.com/errata/RHSA-2020:0159",
        "https://access.redhat.com/errata/RHSA-2020:0160",
        "https://access.redhat.com/errata/RHSA-2020:0161",
        "https://access.redhat.com/errata/RHSA-2020:0164",
        "https://access.redhat.com/errata/RHSA-2020:0445"
    ]
}