FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-providersUpgrade stax-exUpgrade xerces-j2Upgrade velocityUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade python3-nssUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade javassist-javadocUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade glassfish-fastinfoset | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade xmlstreambufferUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade python3-nssUpgrade stax-exUpgrade xerces-j2Upgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade xsomUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade javassist-javadocUpgrade python-nss-debugsourceUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade jakarta-commons-httpclientUpgrade pki-servlet-containerUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade javassistUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2 | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade apache-commons-collectionsUpgrade xsomUpgrade python-nss-docUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade pki-servlet-containerUpgrade javassistUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade resteasyUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade stax-exUpgrade apache-commons-langUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-coreUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade bea-stax-apiUpgrade velocity | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade glassfish-fastinfosetUpgrade resteasyUpgrade javassistUpgrade python-nss-docUpgrade velocityUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade jackson-annotationsUpgrade slf4jUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-containerUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade python-nss-debugsourceUpgrade jackson-coreUpgrade python3-nss | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python3-nss | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub