A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-apiUpgrade velocityUpgrade slf4jUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade jackson-annotationsUpgrade stax-exUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade javassist-javadocUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade xerces-j2Upgrade jackson-coreUpgrade xsomUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2 | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade python-nss-debugsourceUpgrade xmlstreambufferUpgrade pki-symkeyUpgrade jackson-databindUpgrade jssUpgrade slf4j-jdk14Upgrade pki-core-debugsourceUpgrade jss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade xerces-j2Upgrade pki-toolsUpgrade python-nss-docUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade pki-kraUpgrade python3-nssUpgrade pki-caUpgrade python3-nss-debuginfoUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade xml-commons-apisUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade jackson-annotationsUpgrade pki-tools-debuginfoUpgrade jss-debugsourceUpgrade relaxngDatatypeUpgrade pki-serverUpgrade ldapjdkUpgrade javassistUpgrade tomcatjssUpgrade jss-javadocUpgrade apache-commons-langUpgrade xalan-j2Upgrade javassist-javadocUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-apiUpgrade resteasy | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle Missing Cpu Jul 2020 | — | Apply the July 2020 Critical Patch Update (CPU) for Oracle Database | Jul 14, 2020 | Oct 1, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30965714 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30970477 for version 12.2.1.4.0. | Apr 25, 2024 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade jackson-databindUpgrade jssUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade pki-symkeyUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade python-nss-docUpgrade pki-baseUpgrade velocityUpgrade glassfish-jaxb-runtimeUpgrade javassistUpgrade resteasyUpgrade slf4j-jdk14Upgrade stax-exUpgrade pki-toolsUpgrade jss-javadocUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade jackson-annotationsUpgrade pki-serverUpgrade pki-base-javaUpgrade ldapjdk-javadocUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade xalan-j2Upgrade pki-caUpgrade python3-pkiUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade slf4jUpgrade relaxngDatatype | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade jss-debugsourceUpgrade jss-debuginfoUpgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade xalan-j2Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade javassistUpgrade slf4jUpgrade pki-servlet-engineUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade pki-toolsUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade pki-symkeyUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade jackson-annotationsUpgrade pki-tools-debuginfoUpgrade pki-kraUpgrade pki-core-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade jackson-coreUpgrade xml-commons-apisUpgrade pki-caUpgrade xsomUpgrade xerces-j2Upgrade python3-pkiUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade stax-exUpgrade jss-javadocUpgrade glassfish-jaxb-runtimeUpgrade pki-serverUpgrade jackson-jaxrs-json-providerUpgrade tomcatjssUpgrade resteasyUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade xmlstreambufferUpgrade jssUpgrade relaxngDatatypeUpgrade ldapjdk | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub