CVE-2019-10172 Improper Restriction of XML External Entity Reference in jackson-mapper-asl

What is CVE-2019-10172?

CVE-2019-10172 is a medium-severity vulnerability in Debian Debian Linux, published on 18 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

Weakness: CWE-611

Which versions are affected by CVE-2019-10172?

2 open source packages ship an affected version, including org.codehaus.jackson:jackson-mapper-asl. It affects 5 products.

Products include Apache Spark, Debian Debian Linux, Fasterxml Jackson-Mapper-Asl, Redhat Jboss Enterprise Application Platform, Redhat Jboss Fuse.

How do I fix CVE-2019-10172?

Upgrade to a fixed version.

Is CVE-2019-10172 being exploited?

There is no known exploitation of CVE-2019-10172 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2022-33891 Apache Spark Command Injection Exploited High 8.8
• CVE-2020-9480 Improper Authentication in Apache Spark Critical 9.8
• CVE-2018-17190 Remote Code Execution in spark-core Critical 9.8
• CVE-2019-20445 HTTP Request Smuggling in Netty Critical 9.1
• CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability High 8.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2025-1755561926, DEBIAN-CVE-2019-10172, GHSA-r6j9-8759-g62w, OESA-2021-1342, ROOT-APP-MAVEN-CVE-2019-10172, UBUNTU-CVE-2019-10172.