A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade stax-exUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade bea-stax-apiUpgrade python-nss-docUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade velocityUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade jackson-databindUpgrade xml-commons-apisUpgrade jackson-module-jaxb-annotationsUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade xsomUpgrade xml-commons-resolverUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade javassist | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade pki-symkey-debuginfoUpgrade jssUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade pki-toolsUpgrade xsomUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade pki-kraUpgrade jss-debuginfoUpgrade jss-debugsourceUpgrade pki-caUpgrade javassistUpgrade pki-serverUpgrade xalan-j2Upgrade slf4j-jdk14Upgrade pki-symkeyUpgrade velocityUpgrade pki-core-debuginfoUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade jss-javadocUpgrade tomcatjssUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade python-nss-docUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade stax-exUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade jackson-databind | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade xml-commons-apisUpgrade bea-stax-apiUpgrade resteasyUpgrade jackson-databindUpgrade xalan-j2Upgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade pki-base-javaUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade slf4j-jdk14Upgrade pki-serverUpgrade tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade ldapjdkUpgrade stax-exUpgrade pki-kraUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade python3-pkiUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade javassistUpgrade apache-commons-collectionsUpgrade pki-baseUpgrade pki-caUpgrade jakarta-commons-httpclientUpgrade jssUpgrade python-nss-docUpgrade ldapjdk-javadocUpgrade python3-nssUpgrade velocityUpgrade pki-toolsUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade pki-symkeyUpgrade pki-servlet-engine | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Mar 12, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade pki-serverUpgrade python3-pkiUpgrade bea-stax-apiUpgrade pki-base-javaUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade pki-kraUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade pki-tools-debuginfoUpgrade ldapjdk-javadocUpgrade resteasyUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade ldapjdkUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade pki-core-debugsourceUpgrade jss-debugsourceUpgrade slf4jUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade jackson-databindUpgrade jss-javadocUpgrade jackson-coreUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade glassfish-jaxb-txw2Upgrade python-nss-debugsourceUpgrade pki-core-debuginfoUpgrade xsomUpgrade pki-toolsUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade stax-exUpgrade jss-debuginfoUpgrade apache-commons-collectionsUpgrade velocityUpgrade pki-caUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade javassistUpgrade pki-baseUpgrade jssUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade python3-nss | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub