CVE-2019-14379: Apple Xcode

Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days.

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Affected products

  • Apple Xcode: before 13.3 (fixed in 13.3)
  • Debian Debian Linux: version 8.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.6.7.3 (fixed in 2.6.7.3); from 2.7.0, before 2.7.9.6 (fixed in 2.7.9.6); from 2.8.0, before 2.8.11.4 (fixed in 2.8.11.4); from 2.9.0, before 2.9.9.2 (fixed in 2.9.9.2)
  • Fedoraproject Fedora: version 29 only; version 30 only; version 31 only
  • Netapp Active Iq Unified Manager: from 7.3; from 9.5
  • Netapp Oncommand Workflow Automation: affected versions not specified
  • Netapp Service Level Manager: affected versions not specified
  • Netapp Snapcenter: affected versions not specified
  • Oracle Banking Platform: version 2.4.0 only; version 2.4.1 only; version 2.5.0 only; version 2.6.0 only; version 2.6.1 only; version 2.7.0 only; …
  • Oracle Communications Diameter Signaling Router: version 8.0.0 only; version 8.1 only; version 8.2 only; version 8.2.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.3.0 only
  • Oracle Financial Services Analytical Applications Infrastructure: from 8.0.2, up to and including 8.0.8
  • Oracle Goldengate Stream Analytics: before 19.1.0.0.1 (fixed in 19.1.0.0.1)
  • Oracle Jd Edwards Enterpriseone Orchestrator: version 9.2 only
  • Oracle Jd Edwards Enterpriseone Tools: version 9.2 only
  • Oracle Primavera Gateway: version 15.2 only; version 16.2 only; version 17.12 only; version 18.8.0 only
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 16.1 only; version 16.2 only; version 18.8 only
  • Oracle Retail Customer Management And Segmentation Foundation: version 17.0 only
  • Oracle Retail Xstore Point Of Service: version 7.1 only; version 15.0 only; version 16.0 only; version 17.0 only; version 18.0 only
  • Oracle Siebel Engineering - Installer & Deployment: up to and including 19.8
  • Oracle Siebel UI Framework: up to and including 19.10
  • Red Hat JBoss Enterprise Application Platform: version 7.2 only; version 7.3 only
  • Red Hat Openshift Container Platform: version 4.1 only; version 3.11 only
  • Red Hat Single Sign-On: version 7.3 only

Published 2019-07-29. Last modified 2026-10-08.