CVE catalog

CVE-2019-10172

libjackson-json-java: CVE-2019-10172

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
17.04% · Oct 25, 2026

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibjackson-json-javasid1.9.13-2fixed
Debianlibjackson-json-javaforky1.9.13-2fixed
Debianlibjackson-json-javatrixie1.9.13-2fixed
Debianlibjackson-json-javabookworm1.9.13-2fixed
Ubuntulibjackson-json-javapro1.9.2-1vulnerable
Ubuntulibjackson-json-javapro1.9.2-2vulnerable
Ubuntulibjackson-json-javapro1.9.2-3vulnerable
Ubuntulibjackson-json-javapro1.9.2-3+deb8u1build0.14.04.1~esm1fixed
Ubuntulibjackson-json-java16.041.9.2-3vulnerable
Ubuntulibjackson-json-java16.041.9.2-4vulnerable
Ubuntulibjackson-json-java16.041.9.2-5vulnerable
Ubuntulibjackson-json-java16.041.9.2-6vulnerable
Ubuntulibjackson-json-java16.041.9.2-7vulnerable
Ubuntulibjackson-json-java16.041.9.2-7ubuntu0.2fixed
Ubuntulibjackson-json-java18.041.9.2-8vulnerable
Ubuntulibjackson-json-java18.041.9.2-9vulnerable
Ubuntulibjackson-json-java18.041.9.13-1~18.04vulnerable
Ubuntulibjackson-json-java20.041.9.13-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibjackson-json-javasourcesid1.9.13-2not yet assignedNot reportedNot reported
Debianlibjackson-json-javasourceforky1.9.13-2not yet assignedNot reportedNot reported
Debianlibjackson-json-javasourcetrixie1.9.13-2not yet assignedNot reportedNot reported
Debianlibjackson-json-javasourcebookworm1.9.13-2not yet assignedNot reportedNot reported
Ubuntulibjackson-json-javadebpro1.9.2-3+deb8u1build0.14.04.1~esm1Not reportedUBUNTU-CVE-2019-10172Not reported
Ubuntulibjackson-json-javadeb16.041.9.2-7ubuntu0.2Not reportedUBUNTU-CVE-2019-10172Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjackson-json-java]Fixed
    Details (2)

    • 1.9.13-2 · all · bookworm

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · bookworm; dsa · libjackson-json-java · debian · 12

    • 1.9.13-2 · all · bookworm

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · bookworm; dsa · libjackson-json-java · debian · 12

  • [libjackson-json-java-doc]Fixed

    Source package: [libjackson-json-java]

    Details (2)

    • 1.9.13-2 · all · bookworm

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · bookworm; dsa · libjackson-json-java · debian · 12

    • 1.9.13-2 · all · bookworm

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · bookworm; dsa · libjackson-json-java · debian · 12

[Debian 13 (Trixie)]

  • [libjackson-json-java]Fixed
    Details (2)

    • 1.9.13-2 · all · trixie

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · 13

    • 1.9.13-2 · all · trixie

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · 13

  • [libjackson-json-java-doc]Fixed

    Source package: [libjackson-json-java]

    Details (2)

    • 1.9.13-2 · all · trixie

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · 13

    • 1.9.13-2 · all · trixie

      Fixed · Fixed: 1.9.13-2

      dsa · libjackson-json-java · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]