FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade xmlstreambufferUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade velocityUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade slf4jUpgrade xml-commons-apisUpgrade javassistUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade javassist-javadoc | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade glassfish-fastinfosetUpgrade velocityUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade pki-servlet-containerUpgrade javassistUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade resteasyUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-collectionsUpgrade python-nss-debugsourceUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade xsomUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade python3-nssUpgrade xerces-j2Upgrade xmlstreambufferUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtime | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade resteasyUpgrade xerces-j2Upgrade xml-commons-apisUpgrade xmlstreambufferUpgrade bea-stax-apiUpgrade jackson-coreUpgrade jackson-databindUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade relaxngDatatypeUpgrade slf4jUpgrade javassistUpgrade pki-servlet-containerUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade xsomUpgrade jackson-annotationsUpgrade apache-commons-collections | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade glassfish-fastinfosetUpgrade resteasyUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade xsomUpgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade velocityUpgrade javassistUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade pki-servlet-containerUpgrade jackson-coreUpgrade python3-nssUpgrade xml-commons-apisUpgrade slf4jUpgrade stax-exUpgrade python-nss-docUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade python-nss-debugsourceUpgrade jakarta-commons-httpclient | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub