CVE-2019-12384: Debian Linux

Medium severity, CVSS 5.9. EPSS: 45.2% chance of exploitation in the next 30 days.

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Affected products

• Debian Debian Linux: version 8.0 only
• Fasterxml Jackson-Databind: from 2.0.0, before 2.6.7.3 (fixed in 2.6.7.3); from 2.7.0, before 2.7.9.6 (fixed in 2.7.9.6); from 2.8.0, before 2.8.11.4 (fixed in 2.8.11.4); from 2.9.0, before 2.9.9.1 (fixed in 2.9.9.1)
• Red Hat Enterprise Linux: version 7.0 only; version 7.4 only; version 7.5 only; version 7.6 only; version 7.7 only

Published 2019-06-24. Last modified 2026-10-08.