A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
7036DA13-110D-40B3-8494-E361BBF4AFCD
2.6.7.3
2.0.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
89660FC3-9198-414C-B89D-C61A4438BA3B
2.7.9.6
2.7.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
5DB8A2D4-0FDE-4216-896B-52824106B97B
2.8.11.4
2.8.0
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
04641592-DAF4-47BB-A9DE-FC4C84A20401
2.9.9.2
2.9.0
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
D100F7CE-FC64-4CC6-852A-6136D72DA419
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
97A4B8DF-58DA-4AB6-A1F9-331B36409BA3
OR
cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:*
235DC57F-22B8-4219-9499-7D005D90A654
OR
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
A0FED4EE-0AE2-4BD8-8DAC-143382E4DB7C
OR
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
C2BEE49E-A5AA-42D3-B422-460454505480
cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
F4FF66F7-10C8-4A1C-910A-EF7D12A4284C
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
35AD0C07-9688-4397-8D45-FBB88C0F0C11
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
8972497F-6E24-45A9-9A18-EB0E842CB1D4
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
400509A8-D6F2-432C-A2F1-AD5B8778D0D9
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
282150FF-C945-4A3E-8A80-E8757A8907EA
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
645AA3D1-C8B5-4CD2-8ACE-31541FA267F0
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*
A9317C01-22AA-452B-BBBF-5FAFFFB8BEA4
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*
C4534CF9-D9FD-4936-9D8C-077387028A05
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*
D60384BD-284C-4A68-9EEF-0FAFDF0C21F3
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*
FCA44E38-EB8C-4E2D-8611-B201F47520E9
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.3.0:*:*:*:*:*:*:*
FD945A04-174C-46A2-935D-4F92631D1018
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
51433748-DED0-416D-8BFE-F3493E13772E
8.0.8
8.0.2
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
F6455EB1-C741-45E8-A53E-E7AD7A5D00EE
11.2.0.3.23
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
BFD43191-E67F-4D1B-967B-3C7B20331945
12.2.0.1.19
12.2.0.1.0
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*
062C588A-CBBA-470F-8D11-2F961922E927
13.9.4.2.1
13.9.4.0.0
cpe:2.3:a:oracle:global_lifecycle_management_opatch:11.2.0.3.23:*:*:*:*:*:*:*
E074FB89-051D-4E67-BFF9-5D3880F4E8EA
cpe:2.3:a:oracle:global_lifecycle_management_opatch:13.9.4.2.1:*:*:*:*:*:*:*
3F71F9A4-39B3-4027-87DF-BF47DEDC9357
cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*
F4E7F2AA-B851-4D85-9895-2CDD6BE9FCB4
19.1.0.0.1
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2:*:*:*:*:*:*:*
989598A3-7012-4F57-B172-02404E20D16D
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
41684398-18A4-4DC6-B8A2-3EBAA0CBF9A6
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
6951D244-845C-4BF2-AC75-F226B0C39C77
17.12
17.7
cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*
6CBFA960-D242-43ED-8D4C-A60F01B70740
cpe:2.3:a:oracle:primavera_gateway:16.1:*:*:*:*:*:*:*
DADAD14D-4836-4C74-A474-B8A044EED2EB
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
0513B305-97EF-4609-A82E-D0CDFF9925BA
cpe:2.3:a:oracle:primavera_gateway:18.8.0:*:*:*:*:*:*:*
99365245-49E8-4616-BD24-CE564AC1D17E
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*
A7FBF5C7-EC73-4CE4-8CB7-E9CF5705DB25
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
A0ED83E3-E6BF-4EAA-AF8F-33485A88A218
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*
11DA6839-849D-4CEF-85F3-38FE75E07183
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*
BCE78490-A4BE-40BD-8C72-0A4526BBD4A4
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
55AE3629-4A66-49E4-A33D-6D81CC94962F
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:*
4CB39A1A-AD29-45DD-9EB5-5E2053A01B9A
cpe:2.3:a:oracle:siebel_engineering_-_installer_\&_deployment:*:*:*:*:*:*:*:*
25993ED6-D4C7-4B68-9F87-274B757A88CC
19.8
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*
2F10FB4D-A29B-42B4-B70E-EB82A93F2218
19.10
OR
Another gadget type report regarding logback/JNDI.

Mitre id: CVE-2019-14439
Reporter: xiexq@knownsec.com (Badcode of Knownsec 404 Team)

-----

Fixed in:

* 2.9.10
* 2.8.11.4
* 2.7.9.6
* 2.6.7.3

Block one more gadget type (logback, CVE-2019-14439)
This is a GitHub Issue
repo:jackson-databind
owner:FasterXML
Title : Block one more gadget type (logback, CVE-2019-14439)
Issue date:

--- start body ---
Another gadget type report regarding logback/JNDI.

Mitre id: CVE-2019-14439
Reporter: xiexq@knownsec.com (Badcode of Knownsec 404 Team)

-----

Fixed in:

* 2.9.10
* 2.8.11.4
* 2.7.9.6
* 2.6.7.3

--- end body ---

comments :
--- start comments ---

--- end comments ---