CVE:CVE-2019-14892
CNNVD:CNNVD-202001-902
FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。
FasterXML jackson-databind 2.6.7.3之前的2.6.7.x版本、2.8.11.5之前的2.8.x版本和2.9.10之前的2.9.x版本存在代码问题漏洞。攻击者可利用该漏洞执行任意代码。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.6.7.3,2.8.11.5,2.9.10,and avoid the version [2.6.7,2.6.7.3),[2.8.0,2.8.11.5),[2.9.0,2.9.10); Upgrade redhat decision_manager to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat jboss_data_grid to a higher version than -,7.0.0,and avoid the version 7.0.0; Upgrade redhat jboss_enterprise_application_platform to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat jboss_fuse to a higher version than 7.0.0,and avoid the version 7.0.0; Upgrade redhat openshift_container_platform to a higher version than 4.3,and avoid the version 4.3; Upgrade redhat process_automation to a higher version than 7.0,and avoid the version 7.0; Upgrade apache geode to a higher version than 1.12.0,and avoid the version 1.12.0