A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade jackson-coreUpgrade xerces-j2Upgrade xsomUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade javassistUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade python3-nssUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade apache-commons-collections | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade python3-nss-debuginfoUpgrade jssUpgrade jss-debuginfoUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade xmlstreambufferUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade python-nss-debugsourceUpgrade xsomUpgrade python-nss-docUpgrade jackson-jaxrs-providersUpgrade xml-commons-apisUpgrade xerces-j2Upgrade pki-core-debugsourceUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade pki-toolsUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade python3-nssUpgrade pki-caUpgrade pki-symkeyUpgrade apache-commons-collectionsUpgrade python3-pkiUpgrade ldapjdkUpgrade relaxngDatatypeUpgrade ldapjdk-javadocUpgrade pki-symkey-debuginfoUpgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade velocityUpgrade pki-serverUpgrade javassistUpgrade pki-tools-debuginfoUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade javassist-javadocUpgrade jss-debugsourceUpgrade pki-base-javaUpgrade slf4jUpgrade xalan-j2Upgrade apache-commons-langUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclient | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle Missing Cpu Jul 2020 | — | Apply the July 2020 Critical Patch Update (CPU) for Oracle Database | Jul 14, 2020 | Oct 1, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30970477 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 30965714 for version 12.2.1.3.0. | Apr 25, 2024 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade jakarta-commons-httpclientUpgrade jssUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade pki-baseUpgrade jackson-databindUpgrade python3-nssUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade ldapjdkUpgrade bea-stax-apiUpgrade javassistUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade velocityUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade javassist-javadocUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-apiUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade ldapjdk-javadocUpgrade jackson-annotationsUpgrade stax-exUpgrade apache-commons-langUpgrade pki-kraUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade relaxngDatatypeUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade pki-toolsUpgrade pki-base-javaUpgrade xalan-j2Upgrade jackson-jaxrs-providersUpgrade pki-caUpgrade python3-pkiUpgrade jss-javadocUpgrade pki-serverUpgrade xsomUpgrade resteasyUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade jackson-core | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade python3-pkiUpgrade pki-serverUpgrade jackson-jaxrs-json-providerUpgrade tomcatjssUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade xsomUpgrade pki-core-debuginfoUpgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade resteasyUpgrade jssUpgrade pki-kraUpgrade relaxngDatatypeUpgrade xerces-j2Upgrade pki-core-debugsourceUpgrade ldapjdkUpgrade apache-commons-langUpgrade pki-baseUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade jss-javadocUpgrade stax-exUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade xml-commons-resolverUpgrade pki-tools-debuginfoUpgrade jackson-databindUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade pki-toolsUpgrade pki-servlet-engineUpgrade slf4jUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade bea-stax-apiUpgrade javassist-javadocUpgrade glassfish-jaxb-txw2Upgrade pki-base-javaUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade jss-debugsourceUpgrade velocityUpgrade xalan-j2 | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | rocky-upgrade-python-nss-debugsourcerocky-upgrade-python-nss-docrocky-upgrade-python3-nssrocky-upgrade-python3-nss-debuginfo | Mar 12, 2024 | Oct 1, 2019 | |
| Suse | — | suse-upgrade-jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | ubuntu-pro-upgrade-libjackson2-databind-java | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub