CVE-2019-14439: Apache Drill

High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Affected products

  • Apache Drill: version 1.16.0 only
  • Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
  • Fasterxml Jackson-Databind: from 2.0.0, before 2.6.7.3 (fixed in 2.6.7.3); from 2.7.0, before 2.7.9.6 (fixed in 2.7.9.6); from 2.8.0, before 2.8.11.4 (fixed in 2.8.11.4); from 2.9.0, before 2.9.9.2 (fixed in 2.9.9.2)
  • Fedoraproject Fedora: version 29 only; version 30 only
  • Oracle Banking Platform: version 2.4.0 only; version 2.4.1 only; version 2.5.0 only; version 2.6.0 only; version 2.6.1 only; version 2.7.0 only; …
  • Oracle Communications Diameter Signaling Router: version 8.0.0 only; version 8.1 only; version 8.2 only; version 8.2.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.3.0 only
  • Oracle Financial Services Analytical Applications Infrastructure: from 8.0.2, up to and including 8.0.8
  • Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23 (fixed in 11.2.0.3.23); from 12.2.0.1.0, before 12.2.0.1.19 (fixed in 12.2.0.1.19); from 13.9.4.0.0, before 13.9.4.2.1 (fixed in 13.9.4.2.1); version 11.2.0.3.23 only; version 13.9.4.2.1 only
  • Oracle Goldengate Stream Analytics: before 19.1.0.0.1 (fixed in 19.1.0.0.1)
  • Oracle Jd Edwards Enterpriseone Orchestrator: version 9.2 only
  • Oracle Jd Edwards Enterpriseone Tools: version 9.2 only
  • Oracle Primavera Gateway: from 17.7, up to and including 17.12; version 15.2 only; version 16.1 only; version 16.2 only; version 18.8.0 only
  • Oracle Retail Customer Management And Segmentation Foundation: version 17.0 only
  • Oracle Retail Xstore Point Of Service: version 7.1 only; version 15.0 only; version 16.0 only; version 17.0 only; version 18.0 only
  • Oracle Siebel Engineering - Installer & Deployment: up to and including 19.8
  • Oracle Siebel UI Framework: up to and including 19.10
  • Red Hat JBoss Middleware Text-Only Advisories: version 1.0 only

Published 2019-07-30. Last modified 2026-10-08.