A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade velocityUpgrade apache-commons-langUpgrade relaxngDatatypeUpgrade javassistUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade slf4jUpgrade jackson-coreUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade xalan-j2Upgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade jackson-databindUpgrade python3-nss | May 4, 2022 | Oct 12, 2019 |
| Centos_linux | — | Upgrade glassfish-jaxb-txw2Upgrade ldapjdk-javadocUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade pki-caUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade glassfish-fastinfosetUpgrade javassistUpgrade pki-core-debuginfoUpgrade ldapjdkUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade pki-tools-debuginfoUpgrade jssUpgrade jss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade pki-base-javaUpgrade xerces-j2Upgrade pki-baseUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade velocityUpgrade jackson-coreUpgrade jss-javadocUpgrade pki-symkey-debuginfoUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade xsomUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade jss-debugsourceUpgrade slf4jUpgrade python3-nss-debuginfoUpgrade python3-pkiUpgrade pki-kraUpgrade resteasyUpgrade pki-toolsUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade pki-serverUpgrade tomcatjssUpgrade jackson-annotationsUpgrade python-nss-debugsource | Apr 29, 2020 | Oct 12, 2019 |
| Debian | — | Upgrade jackson-databind | Dec 12, 2019 | Oct 12, 2019 |
| Oracle_linux | — | Upgrade stax-exUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade velocityUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclientUpgrade javassistUpgrade bea-stax-apiUpgrade pki-kraUpgrade jssUpgrade jackson-annotationsUpgrade python3-nssUpgrade apache-commons-langUpgrade pki-toolsUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade tomcatjssUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade pki-baseUpgrade ldapjdkUpgrade relaxngDatatypeUpgrade pki-symkeyUpgrade pki-serverUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade jss-javadocUpgrade resteasyUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade javassist-javadoc | Jul 22, 2024 | Oct 12, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 12, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 12, 2019 |
| Redhat_linux | — | Upgrade jackson-databindUpgrade pki-symkey-debuginfoUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade javassistUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade xerces-j2Upgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade python3-pkiUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade pki-tools-debuginfoUpgrade stax-exUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade pki-baseUpgrade jss-debugsourceUpgrade jss-javadocUpgrade pki-servlet-4.0-apiUpgrade tomcatjssUpgrade javassist-javadocUpgrade pki-serverUpgrade relaxngDatatypeUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade pki-core-debugsourceUpgrade jssUpgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade pki-base-javaUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade python-nss-debugsourceUpgrade slf4jUpgrade jss-debuginfoUpgrade glassfish-fastinfosetUpgrade pki-core-debuginfoUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade pki-kraUpgrade xsomUpgrade jackson-annotationsUpgrade resteasyUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade pki-tools | Apr 29, 2020 | Oct 12, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Oct 12, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 12, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub