A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade stax-exUpgrade python3-nssUpgrade xml-commons-apisUpgrade xerces-j2Upgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade velocityUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade xmlstreambufferUpgrade bea-stax-apiUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade xsomUpgrade xml-commons-resolver | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade ldapjdkUpgrade bea-stax-apiUpgrade python3-nssUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade velocityUpgrade jss-javadocUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade python3-pkiUpgrade xerces-j2Upgrade pki-baseUpgrade slf4j-jdk14Upgrade javassist-javadocUpgrade resteasyUpgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade pki-core-debuginfoUpgrade tomcatjssUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade python-nss-debugsourceUpgrade jss-debuginfoUpgrade pki-base-javaUpgrade xsomUpgrade pki-serverUpgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade jssUpgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade pki-toolsUpgrade slf4jUpgrade pki-caUpgrade javassistUpgrade python3-nss-debuginfoUpgrade glassfish-fastinfosetUpgrade xalan-j2 | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade velocityUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade xsomUpgrade javassistUpgrade javassist-javadocUpgrade jssUpgrade pki-caUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-servlet-engineUpgrade jss-javadocUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade python3-pkiUpgrade jackson-databindUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade slf4jUpgrade pki-serverUpgrade jackson-coreUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade pki-base-javaUpgrade xalan-j2Upgrade jackson-annotationsUpgrade stax-exUpgrade relaxngDatatypeUpgrade pki-kraUpgrade tomcatjssUpgrade glassfish-jaxb-api | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Mar 12, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade ldapjdkUpgrade pki-kraUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade pki-symkey-debuginfoUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade tomcatjssUpgrade apache-commons-langUpgrade jackson-databindUpgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade xml-commons-resolverUpgrade pki-tools-debuginfoUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade pki-base-javaUpgrade jackson-coreUpgrade xml-commons-apisUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade python3-pkiUpgrade slf4jUpgrade xmlstreambufferUpgrade xalan-j2Upgrade pki-caUpgrade slf4j-jdk14Upgrade python-nss-debugsourceUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade pki-baseUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade velocityUpgrade jssUpgrade pki-toolsUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade python3-nss-debuginfoUpgrade jakarta-commons-httpclientUpgrade pki-symkeyUpgrade jss-debuginfo | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub