FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade relaxngDatatypeUpgrade xsomUpgrade xml-commons-apisUpgrade javassist-javadocUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade velocityUpgrade python-nss-docUpgrade stax-exUpgrade glassfish-jaxb-api | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade stax-exUpgrade python3-nss-debuginfoUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade xsomUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade python3-nssUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade xerces-j2Upgrade pki-servlet-containerUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade javassistUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade resteasyUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade apache-commons-langUpgrade slf4jUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotations | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade xalan-j2Upgrade xsomUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade slf4jUpgrade relaxngDatatypeUpgrade javassistUpgrade jackson-annotationsUpgrade apache-commons-collectionsUpgrade pki-servlet-containerUpgrade jackson-databindUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade bea-stax-apiUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade stax-exUpgrade python3-nssUpgrade jackson-core | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade javassistUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade velocityUpgrade slf4j-jdk14Upgrade pki-servlet-containerUpgrade xml-commons-apisUpgrade stax-exUpgrade jackson-coreUpgrade slf4jUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade resteasyUpgrade xmlstreambufferUpgrade glassfish-jaxb-txw2Upgrade python3-nss-debuginfoUpgrade javassist-javadocUpgrade xsomUpgrade xerces-j2Upgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade jackson-databind | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub