FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade jackson-databindUpgrade python-nss-docUpgrade stax-exUpgrade jackson-coreUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade velocityUpgrade slf4j-jdk14Upgrade javassistUpgrade xml-commons-resolverUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade javassist-javadocUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade slf4jUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade jackson-annotations | May 13, 2022 | Mar 2, 2020 |
| Centos_linux | — | Upgrade jss-debugsourceUpgrade pki-caUpgrade xalan-j2Upgrade jss-debuginfoUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade slf4jUpgrade pki-serverUpgrade pki-base-javaUpgrade xsomUpgrade jackson-annotationsUpgrade jssUpgrade pki-toolsUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade pki-kraUpgrade javassist-javadocUpgrade python3-nss-debuginfoUpgrade pki-core-debugsourceUpgrade velocityUpgrade python3-nssUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade python3-pkiUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade jackson-coreUpgrade jss-javadocUpgrade jackson-databindUpgrade pki-core-debuginfoUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade pki-baseUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade ldapjdkUpgrade resteasyUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade pki-symkeyUpgrade xml-commons-resolverUpgrade stax-exUpgrade apache-commons-collections | Oct 4, 2021 | Mar 2, 2020 |
| Debian | — | Upgrade jackson-databind | Mar 9, 2020 | Mar 2, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Mar 2, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade pki-toolsUpgrade tomcatjssUpgrade pki-symkeyUpgrade pki-base-javaUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade ldapjdkUpgrade jss-javadocUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade velocityUpgrade pki-serverUpgrade xalan-j2Upgrade jackson-databindUpgrade pki-core-debuginfoUpgrade jackson-annotationsUpgrade pki-core-debugsourceUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade pki-kraUpgrade jackson-jaxrs-json-providerUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade jss-debuginfoUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade resteasyUpgrade apache-commons-collectionsUpgrade relaxngDatatype | Oct 4, 2021 | Mar 2, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss | Mar 12, 2024 | Mar 2, 2020 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Mar 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub