CVE-2019-16943 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-16943 Interim 1 29 2026-03-05T06:07:31Z current 2021-05-30T14:32:05Z 2026-03-05T06:07:31Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-16943 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Liberty Linux 8 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Business Critical Linux 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Manager Retail Branch Server 4.2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Manager Server 4.2 SUSE Linux Enterprise Module for Basesystem 15 SP4 apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-databind jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-databind-2.10.2-1.74 jackson-databind-2.10.5.1-3.3.2 jackson-databind-2.10.5.1-3.5.1 jackson-databind-2.13.4.2-150200.3.12.1 jackson-databind-2.15.2-150200.3.15.1 jackson-databind-2.17.3-150200.3.23.1 jackson-databind-2.17.3-160000.2.2 jackson-databind-javadoc jackson-databind-javadoc-2.17.3-160000.2.2 jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c jss-4.6.2-4.module+el8.2.0+6123+b4678599 jss-javadoc-4.6.2-4.module+el8.2.0+6123+b4678599 ldapjdk-4.21.0-2.module+el8.2.0+4573+c3c38c7b ldapjdk-javadoc-4.21.0-2.module+el8.2.0+4573+c3c38c7b pki-base-10.8.3-1.module+el8.2.0+5925+bad5981a pki-base-java-10.8.3-1.module+el8.2.0+5925+bad5981a pki-ca-10.8.3-1.module+el8.2.0+5925+bad5981a pki-kra-10.8.3-1.module+el8.2.0+5925+bad5981a pki-server-10.8.3-1.module+el8.2.0+5925+bad5981a pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c pki-symkey-10.8.3-1.module+el8.2.0+5925+bad5981a pki-tools-10.8.3-1.module+el8.2.0+5925+bad5981a python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c python3-pki-10.8.3-1.module+el8.2.0+5925+bad5981a relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c resteasy-3.0.26-3.module+el8.1.0+3366+6dfb954c slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c stax-ex-1.7.7-8.module+el8.1.0+3366+6dfb954c tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b velocity-1.7-24.module+el8.1.0+3366+6dfb954c xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c xmlstreambuffer-1.5.4-8.module+el8.1.0+3366+6dfb954c xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d as a component of SUSE Liberty Linux 8 jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d as a component of SUSE Liberty Linux 8 jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jss-4.6.2-4.module+el8.2.0+6123+b4678599 as a component of SUSE Liberty Linux 8 jss-javadoc-4.6.2-4.module+el8.2.0+6123+b4678599 as a component of SUSE Liberty Linux 8 ldapjdk-4.21.0-2.module+el8.2.0+4573+c3c38c7b as a component of SUSE Liberty Linux 8 ldapjdk-javadoc-4.21.0-2.module+el8.2.0+4573+c3c38c7b as a component of SUSE Liberty Linux 8 pki-base-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-base-java-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-ca-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-kra-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-server-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 pki-symkey-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 pki-tools-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 python3-pki-10.8.3-1.module+el8.2.0+5925+bad5981a as a component of SUSE Liberty Linux 8 relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 resteasy-3.0.26-3.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 stax-ex-1.7.7-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b as a component of SUSE Liberty Linux 8 velocity-1.7-24.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xmlstreambuffer-1.5.4-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jackson-databind-2.10.5.1-3.5.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 jackson-databind-2.13.4.2-150200.3.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 jackson-databind-2.15.2-150200.3.15.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 jackson-databind-2.17.3-150200.3.23.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 jackson-databind-2.10.2-1.74 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jackson-databind-2.10.5.1-3.3.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jackson-databind-2.17.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 jackson-databind-javadoc-2.17.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 jackson-databind as a component of SUSE Enterprise Storage 7.1 jackson-databind-javadoc as a component of SUSE Enterprise Storage 7.1 jackson-databind as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS jackson-databind-javadoc as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS jackson-databind as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS jackson-databind-javadoc as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS jackson-databind as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 jackson-databind as a component of SUSE Linux Enterprise Real Time 15 SP3 jackson-databind-javadoc as a component of SUSE Linux Enterprise Real Time 15 SP3 jackson-databind as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP3 jackson-databind as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 jackson-databind-javadoc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 jackson-databind as a component of SUSE Manager Proxy 4.2 jackson-databind-javadoc as a component of SUSE Manager Proxy 4.2 jackson-databind as a component of SUSE Manager Retail Branch Server 4.2 jackson-databind-javadoc as a component of SUSE Manager Retail Branch Server 4.2 jackson-databind as a component of SUSE Manager Server 4.2 jackson-databind-javadoc as a component of SUSE Manager Server 4.2 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling. CVE-2019-16943 SUSE Liberty Linux 8:apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d SUSE Liberty Linux 8:jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d SUSE Liberty Linux 8:jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jss-4.6.2-4.module+el8.2.0+6123+b4678599 SUSE Liberty Linux 8:jss-javadoc-4.6.2-4.module+el8.2.0+6123+b4678599 SUSE Liberty Linux 8:ldapjdk-4.21.0-2.module+el8.2.0+4573+c3c38c7b SUSE Liberty Linux 8:ldapjdk-javadoc-4.21.0-2.module+el8.2.0+4573+c3c38c7b SUSE Liberty Linux 8:pki-base-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-base-java-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-ca-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-kra-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-server-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-servlet-4.0-api-9.0.7-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:pki-servlet-engine-9.0.7-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:pki-symkey-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:pki-tools-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:python3-pki-10.8.3-1.module+el8.2.0+5925+bad5981a SUSE Liberty Linux 8:relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:resteasy-3.0.26-3.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:stax-ex-1.7.7-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:tomcatjss-7.4.1-2.module+el8.2.0+4573+c3c38c7b SUSE Liberty Linux 8:velocity-1.7-24.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xmlstreambuffer-1.5.4-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind-2.10.5.1-3.5.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:jackson-databind-2.13.4.2-150200.3.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:jackson-databind-2.15.2-150200.3.15.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:jackson-databind-2.17.3-150200.3.23.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:jackson-databind-2.10.2-1.74 SUSE Linux Enterprise Module for Development Tools 15 SP3:jackson-databind-2.10.5.1-3.3.2 SUSE Linux Enterprise Server 16.0:jackson-databind-2.17.3-160000.2.2 SUSE Linux Enterprise Server 16.0:jackson-databind-javadoc-2.17.3-160000.2.2 SUSE Enterprise Storage 7.1:jackson-databind SUSE Enterprise Storage 7.1:jackson-databind-javadoc SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:jackson-databind SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:jackson-databind-javadoc SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:jackson-databind SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:jackson-databind-javadoc SUSE Linux Enterprise Module for Basesystem 15 SP4:jackson-databind SUSE Linux Enterprise Real Time 15 SP3:jackson-databind SUSE Linux Enterprise Real Time 15 SP3:jackson-databind-javadoc SUSE Linux Enterprise Server Business Critical Linux 15 SP3:jackson-databind SUSE Linux Enterprise Server for SAP Applications 15 SP3:jackson-databind SUSE Linux Enterprise Server for SAP Applications 15 SP3:jackson-databind-javadoc SUSE Manager Proxy 4.2:jackson-databind SUSE Manager Proxy 4.2:jackson-databind-javadoc SUSE Manager Retail Branch Server 4.2:jackson-databind SUSE Manager Retail Branch Server 4.2:jackson-databind-javadoc SUSE Manager Server 4.2:jackson-databind SUSE Manager Server 4.2:jackson-databind-javadoc important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N