A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade stax-exUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade velocityUpgrade python-nss-docUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade xerces-j2Upgrade python3-nssUpgrade jackson-databindUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade xsomUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade relaxngDatatype | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade ldapjdk-javadocUpgrade slf4jUpgrade jssUpgrade jackson-jaxrs-providersUpgrade pki-caUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade pki-base-javaUpgrade javassistUpgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade jakarta-commons-httpclientUpgrade xsomUpgrade relaxngDatatypeUpgrade jss-debugsourceUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade pki-toolsUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade pki-serverUpgrade pki-kraUpgrade pki-symkey-debuginfoUpgrade pki-servlet-engineUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade tomcatjssUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade apache-commons-langUpgrade jackson-coreUpgrade xmlstreambufferUpgrade pki-core-debuginfoUpgrade resteasyUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade python3-nssUpgrade xml-commons-resolverUpgrade velocityUpgrade stax-exUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade ldapjdkUpgrade jss-javadocUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade python3-pki | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade xmlstreambufferUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade pki-servlet-4.0-apiUpgrade jackson-coreUpgrade xml-commons-apisUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade tomcatjssUpgrade resteasyUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade python3-pkiUpgrade relaxngDatatypeUpgrade stax-exUpgrade jackson-databindUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade xerces-j2Upgrade jackson-annotationsUpgrade pki-serverUpgrade jss-javadocUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade pki-caUpgrade python-nss-docUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade xsomUpgrade jssUpgrade javassistUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade pki-toolsUpgrade velocityUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade ldapjdk-javadoc | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Mar 12, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade apache-commons-langUpgrade jss-javadocUpgrade python3-pkiUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade pki-tools-debuginfoUpgrade xerces-j2Upgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade pki-base-javaUpgrade pki-serverUpgrade resteasyUpgrade jss-debugsourceUpgrade jackson-annotationsUpgrade pki-symkey-debuginfoUpgrade pki-kraUpgrade ldapjdkUpgrade xsomUpgrade javassistUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade jackson-jaxrs-providersUpgrade pki-symkeyUpgrade stax-exUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade python3-nss-debuginfoUpgrade jssUpgrade slf4j-jdk14Upgrade glassfish-jaxb-txw2Upgrade jss-debuginfoUpgrade pki-toolsUpgrade glassfish-jaxb-coreUpgrade apache-commons-collections | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub