FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassistUpgrade bea-stax-apiUpgrade python-nss-docUpgrade python3-nssUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade xsomUpgrade jackson-annotationsUpgrade jackson-coreUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade relaxngDatatypeUpgrade xalan-j2 | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade pki-servlet-engineUpgrade jss-debuginfoUpgrade javassistUpgrade python-nss-debugsourceUpgrade pki-tools-debuginfoUpgrade jakarta-commons-httpclientUpgrade pki-caUpgrade bea-stax-apiUpgrade ldapjdk-javadocUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade xsomUpgrade pki-core-debugsourceUpgrade velocityUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-txw2Upgrade jssUpgrade javassist-javadocUpgrade pki-baseUpgrade pki-symkey-debuginfoUpgrade python3-nssUpgrade pki-symkeyUpgrade jss-javadocUpgrade pki-kraUpgrade resteasyUpgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade python3-pkiUpgrade apache-commons-langUpgrade pki-toolsUpgrade jss-debugsourceUpgrade jackson-databindUpgrade pki-base-javaUpgrade xml-commons-apisUpgrade xerces-j2Upgrade pki-serverUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade glassfish-jaxb-runtimeUpgrade tomcatjssUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-providersUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotations | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade glassfish-jaxb-apiUpgrade stax-exUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade jss-debuginfoUpgrade jss-debugsourceUpgrade pki-symkey-debuginfoUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade pki-symkeyUpgrade python3-nssUpgrade xsomUpgrade python-nss-docUpgrade javassistUpgrade velocityUpgrade jssUpgrade python3-nss-debuginfoUpgrade pki-base-javaUpgrade slf4jUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-coreUpgrade pki-toolsUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade pki-kraUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade python3-pkiUpgrade pki-servlet-4.0-apiUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade xmlstreambufferUpgrade jackson-coreUpgrade jackson-databindUpgrade xalan-j2Upgrade tomcatjssUpgrade xml-commons-apisUpgrade jss-javadocUpgrade pki-core-debugsourceUpgrade relaxngDatatypeUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade xml-commons-resolverUpgrade ldapjdkUpgrade pki-serverUpgrade pki-core-debuginfoUpgrade jackson-annotationsUpgrade xerces-j2Upgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade apache-commons-langUpgrade slf4j-jdk14 | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub