A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slf4jUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade velocityUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade xsomUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade glassfish-jaxb-coreUpgrade xalan-j2Upgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade xerces-j2Upgrade python-nss-docUpgrade relaxngDatatype | May 4, 2022 | Oct 1, 2019 |
| Centos_linux | — | Upgrade jackson-databindUpgrade slf4j-jdk14Upgrade stax-exUpgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade jackson-coreUpgrade python3-nssUpgrade xmlstreambufferUpgrade pki-kraUpgrade xsomUpgrade python3-nss-debuginfoUpgrade xml-commons-apisUpgrade pki-baseUpgrade jackson-jaxrs-json-providerUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade xerces-j2Upgrade pki-toolsUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade python-nss-debugsourceUpgrade jss-debuginfoUpgrade jssUpgrade javassistUpgrade javassist-javadocUpgrade apache-commons-langUpgrade resteasyUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade velocityUpgrade python3-pkiUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade ldapjdkUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade pki-base-javaUpgrade jakarta-commons-httpclientUpgrade slf4jUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade bea-stax-apiUpgrade pki-symkey-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade jss-javadocUpgrade ldapjdk-javadocUpgrade pki-tools-debuginfoUpgrade pki-server | Apr 29, 2020 | Oct 1, 2019 |
| Debian | — | Upgrade jackson-databind | Oct 4, 2019 | Oct 1, 2019 |
| Oracle Missing Cpu Jul 2020 | — | Apply the July 2020 Critical Patch Update (CPU) for Oracle Database | Jul 14, 2020 | Oct 1, 2019 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 30965714 for version 12.2.1.3.0.Apply the Patch Set Update (PSU) 30970477 for version 12.2.1.4.0. | Apr 25, 2024 | Oct 1, 2019 |
| Oracle_linux | — | Upgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade jssUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade python-nss-docUpgrade javassistUpgrade xml-commons-resolverUpgrade velocityUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade jackson-databindUpgrade pki-symkeyUpgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade pki-base-javaUpgrade stax-exUpgrade xml-commons-apisUpgrade slf4j-jdk14Upgrade jss-javadocUpgrade pki-serverUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade pki-servlet-engineUpgrade pki-caUpgrade xalan-j2Upgrade python3-pkiUpgrade pki-toolsUpgrade slf4jUpgrade xsomUpgrade ldapjdk-javadocUpgrade tomcatjssUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade apache-commons-langUpgrade jackson-jaxrs-json-provider | Jul 22, 2024 | Sep 27, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 27, 2019 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade resteasyUpgrade pki-core-debuginfoUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade stax-exUpgrade pki-servlet-4.0-apiUpgrade relaxngDatatypeUpgrade xsomUpgrade xml-commons-resolverUpgrade jackson-module-jaxb-annotationsUpgrade pki-baseUpgrade python3-nss-debuginfoUpgrade pki-core-debugsourceUpgrade tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade python3-pkiUpgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade pki-kraUpgrade pki-caUpgrade pki-serverUpgrade jackson-annotationsUpgrade jssUpgrade jackson-databindUpgrade jss-javadocUpgrade ldapjdkUpgrade jss-debugsourceUpgrade xalan-j2Upgrade python3-nssUpgrade jss-debuginfoUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade pki-symkeyUpgrade slf4jUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade javassistUpgrade pki-servlet-engineUpgrade pki-symkey-debuginfoUpgrade pki-toolsUpgrade velocityUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-txw2Upgrade python-nss-doc | Apr 29, 2020 | Oct 1, 2019 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | Oct 1, 2019 |
| Suse | — | Upgrade jackson-databind | Feb 4, 2022 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libjackson2-databind-java (Ubuntu Pro) | Mar 22, 2023 | Oct 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub