The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade javassistUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade jakarta-commons-httpclientUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade velocityUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade xerces-j2 | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade jackson-jaxrs-providersUpgrade xsomUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade xerces-j2Upgrade stax-exUpgrade pki-servlet-4.0-apiUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade jackson-coreUpgrade relaxngDatatypeUpgrade javassistUpgrade python-nss-debugsourceUpgrade bea-stax-apiUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade pki-servlet-containerUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade xalan-j2Upgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collections | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade javassist-javadocUpgrade python-nss-docUpgrade xsomUpgrade jackson-annotationsUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade relaxngDatatypeUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-containerUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade resteasyUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade velocityUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade xerces-j2Upgrade stax-exUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade xmlstreambuffer | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade apache-commons-langUpgrade slf4jUpgrade xml-commons-apisUpgrade pki-servlet-containerUpgrade slf4j-jdk14Upgrade javassistUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade stax-exUpgrade bea-stax-apiUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade jackson-databindUpgrade xerces-j2Upgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade xmlstreambufferUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolver | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub