A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xsomUpgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade python-nss-docUpgrade javassist-javadocUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade jackson-coreUpgrade jackson-databindUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade javassistUpgrade jackson-annotationsUpgrade velocityUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclientUpgrade stax-exUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade python3-nssUpgrade slf4jUpgrade jackson-jaxrs-providers | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade pki-servlet-4.0-apiUpgrade jss-debuginfoUpgrade jssUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade xml-commons-resolverUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade python-nss-docUpgrade jackson-databindUpgrade xerces-j2Upgrade xmlstreambufferUpgrade python-nss-debugsourceUpgrade xsomUpgrade pki-baseUpgrade stax-exUpgrade pki-kraUpgrade pki-toolsUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-providerUpgrade pki-caUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade python3-nssUpgrade javassist-javadocUpgrade apache-commons-langUpgrade jss-javadocUpgrade resteasyUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-engineUpgrade python3-pkiUpgrade tomcatjssUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade jss-debugsourceUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade javassistUpgrade pki-serverUpgrade pki-tools-debuginfoUpgrade apache-commons-collectionsUpgrade pki-base-javaUpgrade bea-stax-apiUpgrade xalan-j2 | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle Missing Cpu Jul 2020 | — | Apply the July 2020 Critical Patch Update (CPU) for Oracle Database | Jul 14, 2020 | Oct 1, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30970477 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 30965714 for version 12.2.1.3.0. | Apr 25, 2024 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade pki-serverUpgrade jss-javadocUpgrade slf4j-jdk14Upgrade pki-kraUpgrade jackson-annotationsUpgrade slf4jUpgrade xsomUpgrade tomcatjssUpgrade pki-base-javaUpgrade pki-caUpgrade relaxngDatatypeUpgrade apache-commons-langUpgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade stax-exUpgrade resteasyUpgrade pki-toolsUpgrade xalan-j2Upgrade python3-pkiUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade pki-servlet-4.0-apiUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade velocityUpgrade pki-symkeyUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-baseUpgrade jackson-databindUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade python-nss-docUpgrade jssUpgrade javassistUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2 | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade javassist-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade pki-symkeyUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade jss-debugsourceUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade jss-debuginfoUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade velocityUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade pki-toolsUpgrade pki-symkey-debuginfoUpgrade javassistUpgrade pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade xmlstreambufferUpgrade pki-caUpgrade python3-pkiUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade xml-commons-apisUpgrade xsomUpgrade pki-core-debugsourceUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade pki-core-debuginfoUpgrade apache-commons-langUpgrade stax-exUpgrade python3-nss-debuginfoUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade resteasyUpgrade jackson-databindUpgrade tomcatjssUpgrade pki-kraUpgrade jss-javadocUpgrade jssUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade relaxngDatatypeUpgrade ldapjdkUpgrade jackson-module-jaxb-annotationsUpgrade pki-tools-debuginfo | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub