A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-providersUpgrade stax-exUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade xerces-j2Upgrade xmlstreambufferUpgrade velocityUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade python-nss-docUpgrade jackson-annotationsUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade python3-nssUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade jackson-databindUpgrade xsomUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade javassist-javadocUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-core | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade tomcatjssUpgrade glassfish-jaxb-apiUpgrade jss-javadocUpgrade bea-stax-apiUpgrade resteasyUpgrade pki-tools-debuginfoUpgrade pki-core-debugsourceUpgrade apache-commons-langUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade python3-pkiUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade pki-symkeyUpgrade javassist-javadocUpgrade slf4j-jdk14Upgrade pki-baseUpgrade stax-exUpgrade jackson-databindUpgrade velocityUpgrade jackson-coreUpgrade ldapjdkUpgrade xmlstreambufferUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade relaxngDatatypeUpgrade pki-symkey-debuginfoUpgrade glassfish-fastinfosetUpgrade ldapjdk-javadocUpgrade pki-caUpgrade slf4jUpgrade pki-serverUpgrade jss-debugsourceUpgrade javassistUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade xsomUpgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade xml-commons-apisUpgrade pki-servlet-engineUpgrade python3-nss-debuginfoUpgrade jackson-annotationsUpgrade jssUpgrade pki-toolsUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2 | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade xsomUpgrade pki-servlet-engineUpgrade jssUpgrade pki-symkeyUpgrade javassist-javadocUpgrade python-nss-docUpgrade javassistUpgrade ldapjdk-javadocUpgrade pki-baseUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade velocityUpgrade pki-caUpgrade glassfish-jaxb-coreUpgrade pki-toolsUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade python3-pkiUpgrade xml-commons-resolverUpgrade tomcatjssUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade xml-commons-apisUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade jackson-databindUpgrade bea-stax-apiUpgrade slf4jUpgrade pki-servlet-4.0-apiUpgrade pki-kraUpgrade jackson-coreUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade pki-serverUpgrade stax-exUpgrade xalan-j2Upgrade pki-base-javaUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade jss-javadocUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-api | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Mar 12, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade glassfish-jaxb-coreUpgrade pki-toolsUpgrade pki-baseUpgrade slf4j-jdk14Upgrade jss-debuginfoUpgrade xsomUpgrade python3-nssUpgrade pki-core-debuginfoUpgrade python-nss-debugsourceUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade javassistUpgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade stax-exUpgrade resteasyUpgrade pki-kraUpgrade xmlstreambufferUpgrade ldapjdkUpgrade tomcatjssUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-coreUpgrade glassfish-fastinfosetUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade pki-core-debugsourceUpgrade javassist-javadocUpgrade jss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade pki-tools-debuginfoUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade python3-pkiUpgrade xerces-j2Upgrade pki-base-javaUpgrade bea-stax-apiUpgrade xml-commons-resolverUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade slf4jUpgrade pki-serverUpgrade xalan-j2 | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub