A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xml-commons-resolverUpgrade javassistUpgrade xsomUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade slf4jUpgrade python-nss-docUpgrade xml-commons-apisUpgrade jackson-databindUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade python3-nssUpgrade stax-ex | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade jss-debuginfoUpgrade xsomUpgrade jakarta-commons-httpclientUpgrade pki-base-javaUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade relaxngDatatypeUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade pki-kraUpgrade pki-caUpgrade xml-commons-apisUpgrade pki-toolsUpgrade pki-serverUpgrade xalan-j2Upgrade jss-debugsourceUpgrade glassfish-fastinfosetUpgrade jssUpgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade ldapjdk-javadocUpgrade javassistUpgrade jackson-databindUpgrade pki-baseUpgrade tomcatjssUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-json-providerUpgrade jss-javadocUpgrade xerces-j2Upgrade python3-pkiUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade pki-core-debugsourceUpgrade python3-nssUpgrade glassfish-jaxb-coreUpgrade stax-exUpgrade velocityUpgrade javassist-javadocUpgrade pki-symkeyUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade pki-core-debuginfoUpgrade pki-tools-debuginfoUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade resteasyUpgrade jackson-coreUpgrade slf4j-jdk14Upgrade python-nss-doc | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade glassfish-fastinfosetUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade xalan-j2Upgrade pki-base-javaUpgrade jackson-coreUpgrade relaxngDatatypeUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade jss-javadocUpgrade jackson-annotationsUpgrade ldapjdkUpgrade tomcatjssUpgrade pki-kraUpgrade python3-pkiUpgrade jackson-databindUpgrade resteasyUpgrade bea-stax-apiUpgrade pki-serverUpgrade slf4j-jdk14Upgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade pki-caUpgrade pki-servlet-engineUpgrade xsomUpgrade pki-toolsUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade python-nss-docUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade velocityUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade pki-symkey | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Mar 12, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade pki-serverUpgrade slf4jUpgrade python3-pkiUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade xml-commons-apisUpgrade jss-javadocUpgrade pki-tools-debuginfoUpgrade relaxngDatatypeUpgrade ldapjdkUpgrade jss-debugsourceUpgrade apache-commons-langUpgrade xalan-j2Upgrade xerces-j2Upgrade bea-stax-apiUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade jackson-annotationsUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade resteasyUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade pki-kraUpgrade jackson-coreUpgrade tomcatjssUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade velocityUpgrade javassistUpgrade pki-symkeyUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade slf4j-jdk14Upgrade jss-debuginfoUpgrade python3-nssUpgrade pki-baseUpgrade jssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade python3-nss-debuginfoUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade stax-exUpgrade jakarta-commons-httpclient | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub