FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade slf4jUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade xsomUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade velocityUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade python3-nssUpgrade slf4j-jdk14 | May 4, 2022 | Mar 18, 2020 |
| Centos_linux | — | Upgrade glassfish-jaxb-txw2Upgrade python3-nss-debuginfoUpgrade xml-commons-apisUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade javassistUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade tomcatjssUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade pki-caUpgrade python-nss-debugsourceUpgrade resteasyUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade pki-serverUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade pki-baseUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade slf4jUpgrade jss-debugsourceUpgrade glassfish-jaxb-coreUpgrade pki-base-javaUpgrade python3-pkiUpgrade bea-stax-apiUpgrade jss-debuginfoUpgrade ldapjdkUpgrade pki-symkeyUpgrade glassfish-jaxb-apiUpgrade pki-symkey-debuginfoUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade pki-kraUpgrade pki-servlet-engineUpgrade jssUpgrade python-nss-docUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade jackson-coreUpgrade stax-exUpgrade velocityUpgrade pki-tools-debuginfo | Sep 8, 2020 | Mar 18, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 23, 2020 | Mar 18, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 18, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 18, 2020 |
| Redhat_linux | — | Upgrade pki-serverUpgrade pki-toolsUpgrade stax-exUpgrade relaxngDatatypeUpgrade python3-nss-debuginfoUpgrade velocityUpgrade xml-commons-apisUpgrade tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade pki-symkey-debuginfoUpgrade jackson-coreUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade jss-debugsourceUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade ldapjdk-javadocUpgrade jss-javadocUpgrade jss-debuginfoUpgrade python3-pkiUpgrade jackson-annotationsUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade apache-commons-langUpgrade slf4jUpgrade python-nss-debugsourceUpgrade xerces-j2Upgrade pki-core-debuginfoUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade pki-baseUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade pki-caUpgrade jssUpgrade pki-base-javaUpgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade pki-symkeyUpgrade javassistUpgrade pki-core-debugsourceUpgrade python-nss-docUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade xsomUpgrade pki-tools-debuginfo | Sep 8, 2020 | Mar 18, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Mar 18, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub