CVE-2019-14540 in Primavera Unifier
Summary
by MITRE
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/17/2025
The vulnerability CVE-2019-14540 represents a polymorphic typing issue within the FasterXML jackson-databind library version 2.9.9 and earlier, which creates a significant security risk when processing untrusted data. This flaw specifically manifests when the library processes serialized objects that contain polymorphic type information, allowing attackers to execute arbitrary code during deserialization operations. The vulnerability is particularly concerning because it affects a widely used JSON processing library that many applications rely upon for data interchange and configuration management.
The technical root cause of this vulnerability lies in how jackson-databind handles polymorphic type information during deserialization, particularly when dealing with classes from the com.zaxxer.hikari.HikariConfig package. This package is commonly used for database connection pooling in enterprise applications, making the attack vector more dangerous as it can potentially be exploited in applications that process user-supplied JSON data. The vulnerability allows an attacker to craft malicious JSON payloads that, when processed by the vulnerable library, can trigger unintended code execution on the target system. This represents a classic deserialization vulnerability where the attacker can manipulate the type information to load and execute arbitrary classes from the classpath.
The operational impact of CVE-2019-14540 is substantial across multiple application types and deployment scenarios. Applications that deserialize JSON data from external sources, including web services, APIs, and configuration files, become vulnerable to remote code execution attacks. The vulnerability affects not only web applications but also backend services, microservices, and enterprise applications that utilize jackson-databind for data processing. Attackers can exploit this vulnerability to execute arbitrary commands on the target system, potentially leading to complete system compromise, data exfiltration, or lateral movement within network environments. The attack requires minimal privileges and can be executed remotely, making it particularly dangerous for publicly accessible services.
Organizations should immediately upgrade to jackson-databind version 2.9.10 or later to remediate this vulnerability, as this release includes patches that address the polymorphic typing issue. Security teams should also implement additional protective measures such as disabling the default typing feature in jackson-databind when processing untrusted data, implementing proper input validation, and monitoring for suspicious deserialization activities. The vulnerability aligns with CWE-502, which describes deserialization of untrusted data, and falls under ATT&CK technique T1203, which covers Exploitation for Client Execution. Organizations should conduct comprehensive vulnerability assessments to identify all applications using vulnerable versions of the library and ensure proper patch management procedures are in place to prevent similar issues in the future.