FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade stax-exUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade xerces-j2Upgrade velocityUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotations | May 13, 2022 | Jun 24, 2019 |
| Centos_linux | — | Upgrade apache-commons-langUpgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade apache-commons-collectionsUpgrade javassistUpgrade slf4jUpgrade jackson-annotationsUpgrade pki-servlet-containerUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade python-nss-debugsourceUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade xsomUpgrade jackson-coreUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade python-nss-docUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade stax-ex | Sep 12, 2019 | Jun 24, 2019 |
| Debian | — | Upgrade jackson-databind | Jun 24, 2019 | Jun 24, 2019 |
| Oracle_linux | — | Upgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade xerces-j2Upgrade resteasyUpgrade bea-stax-apiUpgrade stax-exUpgrade slf4j-jdk14Upgrade velocityUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade python3-nssUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade jackson-databindUpgrade javassistUpgrade xsomUpgrade python-nss-docUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade pki-servlet-containerUpgrade jackson-annotationsUpgrade apache-commons-collections | Oct 5, 2022 | Jun 21, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2019 |
| Redhat Openshift | — | Upgrade logging | Oct 8, 2019 | Jun 24, 2019 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade xsomUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade resteasyUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade slf4j-jdk14Upgrade xml-commons-apisUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade bea-stax-apiUpgrade javassistUpgrade stax-exUpgrade velocityUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade pki-servlet-container | Sep 12, 2019 | Jun 24, 2019 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nss | Mar 12, 2024 | Jun 24, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Jun 24, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Jun 24, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub