FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade xsomUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade javassist-javadocUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade xerces-j2Upgrade python-nss-docUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade stax-exUpgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade velocity | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade python-nss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade resteasyUpgrade javassist-javadocUpgrade javassistUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade pki-servlet-containerUpgrade xerces-j2Upgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade pki-servlet-4.0-apiUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade stax-exUpgrade jackson-jaxrs-json-provider | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade xerces-j2Upgrade resteasyUpgrade bea-stax-apiUpgrade python3-nssUpgrade xmlstreambufferUpgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade stax-exUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade velocityUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade apache-commons-collectionsUpgrade jackson-annotationsUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade relaxngDatatypeUpgrade pki-servlet-containerUpgrade javassist-javadocUpgrade xsomUpgrade xalan-j2Upgrade jakarta-commons-httpclient | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade xsomUpgrade jackson-databindUpgrade resteasyUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade xalan-j2Upgrade glassfish-jaxb-runtimeUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade python3-nssUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade bea-stax-apiUpgrade xml-commons-apisUpgrade velocityUpgrade apache-commons-collectionsUpgrade jackson-annotationsUpgrade pki-servlet-containerUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade javassist | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-nss | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub