CVE-2019-16943

A Polymorphic Typing issue was discovered in FasterXML jackson-databind
2.0.0 through 2.9.10. When Default Typing is enabled (either globally or
for a specific property) for an externally exposed JSON endpoint and the
service has the p6spy (3.8.6) jar in the classpath, and an attacker can
find an RMI service endpoint to access, it is possible to make the service
execute a malicious payload. This issue exists because of
com.p6spy.engine.spy.P6DataSource mishandling.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941530&gt;