FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade velocityUpgrade stax-exUpgrade bea-stax-apiUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade xmlstreambufferUpgrade xerces-j2Upgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade javassist | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade apache-commons-langUpgrade pki-servlet-containerUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade velocityUpgrade javassist-javadocUpgrade javassistUpgrade xalan-j2Upgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-coreUpgrade relaxngDatatypeUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade slf4j-jdk14Upgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade stax-exUpgrade xml-commons-resolverUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade xerces-j2Upgrade jackson-databindUpgrade python-nss-docUpgrade xsomUpgrade python3-nss | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade relaxngDatatypeUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade javassistUpgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade pki-servlet-containerUpgrade slf4jUpgrade xsomUpgrade javassist-javadocUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade xmlstreambufferUpgrade resteasyUpgrade slf4j-jdk14Upgrade glassfish-jaxb-coreUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade python3-nssUpgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade jackson-coreUpgrade jackson-databindUpgrade xml-commons-apisUpgrade stax-exUpgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade glassfish-fastinfoset | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade resteasyUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade python3-nss-debuginfoUpgrade xmlstreambufferUpgrade xsomUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade python3-nssUpgrade jackson-coreUpgrade velocityUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade python-nss-docUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade javassistUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade pki-servlet-containerUpgrade slf4jUpgrade glassfish-jaxb-api | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub